From 801413240e20c8a10aba67b53746b2db423cb2f8 Mon Sep 17 00:00:00 2001 From: ljstella Date: Mon, 25 Nov 2024 13:19:11 -0600 Subject: [PATCH] Updates with develop --- .../microsoft_defender_atp_alerts.yml | 50 ++++++++----------- .../microsoft_defender_incident_alerts.yml | 50 ++++++++----------- .../windows_runmru_command_execution.yml | 26 +++++----- 3 files changed, 52 insertions(+), 74 deletions(-) diff --git a/detections/endpoint/microsoft_defender_atp_alerts.yml b/detections/endpoint/microsoft_defender_atp_alerts.yml index 20bd0b9e37..73888bb882 100644 --- a/detections/endpoint/microsoft_defender_atp_alerts.yml +++ b/detections/endpoint/microsoft_defender_atp_alerts.yml @@ -31,6 +31,26 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: $severity$ alert for $src$ - $signature$ + risk_objects: + - field: src + type: system + score: 81 + - field: user + type: user + score: 81 + threat_objects: + - field: file_name + type: file_name + - field: process + type: process_name + - field: ip_address + type: ip_address + - field: registry_key + type: registry_path + - field: url + type: url tags: analytic_story: - Critical Alerts @@ -38,37 +58,7 @@ tags: atomic_guid: [] confidence: 90 impact: 90 - message: $severity$ alert for $src$ - $signature$ mitre_attack_id: [] - observable: - - name: src - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - - name: file_name - type: File Name - role: - - Attacker - - name: process - type: Process Name - role: - - Attacker - - name: ip_address - type: IP Address - role: - - Attacker - - name: registry_key - type: Registry Key - role: - - Attacker - - name: url - type: URL String - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/microsoft_defender_incident_alerts.yml b/detections/endpoint/microsoft_defender_incident_alerts.yml index 324d8b7573..8373752bdb 100644 --- a/detections/endpoint/microsoft_defender_incident_alerts.yml +++ b/detections/endpoint/microsoft_defender_incident_alerts.yml @@ -37,6 +37,26 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: $severity$ alert for $dest$ - $signature$ + risk_objects: + - field: dest + type: system + score: 81 + - field: user + type: user + score: 81 + threat_objects: + - field: file_name + type: file_name + - field: process + type: process_name + - field: ip_address + type: ip_address + - field: registry_key + type: registry_path + - field: url + type: url tags: analytic_story: - Critical Alerts @@ -44,37 +64,7 @@ tags: atomic_guid: [] confidence: 90 impact: 90 - message: $severity$ alert for $dest$ - $signature$ mitre_attack_id: [] - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - - name: file_name - type: File Name - role: - - Attacker - - name: process - type: Process Name - role: - - Attacker - - name: ip_address - type: IP Address - role: - - Attacker - - name: registry_key - type: Registry Key - role: - - Attacker - - name: url - type: URL String - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_runmru_command_execution.yml b/detections/endpoint/windows_runmru_command_execution.yml index 1edfd9e447..df145532fc 100644 --- a/detections/endpoint/windows_runmru_command_execution.yml +++ b/detections/endpoint/windows_runmru_command_execution.yml @@ -26,28 +26,26 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: An instance of $registry_value_data$ was identified on endpoint $dest$ by user $user$ attempting to execute a command through the Run dialog box. + risk_objects: + - field: dest + type: system + score: 48 + - field: user + type: user + score: 48 + threat_objects: + - field: registry_value_data + type: registry_value_text tags: analytic_story: - Lumma Stealer asset_type: Endpoint confidence: 60 impact: 80 - message: An instance of $registry_value_data$ was identified on endpoint $dest$ by user $user$ attempting to execute a command through the Run dialog box. mitre_attack_id: - T1202 - observable: - - name: registry_value_data - type: Registry Value - role: - - Attacker - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security