admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

bug in generate

Browse Source
This commit is contained in:
Patrick Bareiss
2020-05-11 17:40:06 +02:00
parent 7ad2bb485c
commit 804e2e8248
7 changed files with 331 additions and 316 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/generate.py
+15
View File
@@ -156,6 +156,21 @@ def generate_use_case_library_conf(stories, detections, response_tasks, baseline
else:
story['searches'] = story['detections']
for detection in detections:
keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist']
mappings = {}
for key in keys:
if key == 'mitre_attack':
if 'mitre_attack_id' in detection['tags']:
mappings[key] = detection['tags']['mitre_attack_id']
else:
if key in detection['tags']:
mappings[key] = detection['tags'][key]
detection['mappings'] = mappings
utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
j2_env = Environment(loader=FileSystemLoader('bin/jinja2_templates'),
bin/jinja2_templates/use_case_library.j2
+1 -1
View File
@@ -37,7 +37,7 @@ how_to_implement = {{ detection.how_to_implement }}
{% else %}
how_to_implement = none
{% endif %}
annotations = {{ detection.tags | tojson }}
annotations = {{ detection.mappings | tojson }}
known_false_positives = {{ detection.known_false_positives }}
providing_technologies = none
package/default/analytic_stories.conf
+59 -59
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security-content
# On Date: 2020-05-11T12:39:19 UTC
# On Date: 2020-05-11T15:39:38 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -16,7 +16,7 @@ version = 1
reference = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/"]
detection_searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule"]
mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.AE"]}
investigative_searches = ["ESCU - Get Notable History", "ESCU - AWS Investigate User Activities By Source User", "ESCU - AWS Investigate User Activities By AccessKeyId"]
investigative_searches = ["ESCU - AWS Investigate User Activities By AccessKeyId", "ESCU - AWS Investigate User Activities By Source User", "ESCU - Get Notable History"]
support_searches = []
data_models = []
providing_technologies = none
@@ -34,7 +34,7 @@ version = 1
reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
detection_searches = ["ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule"]
mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.AE", "DE.DP", "ID.AM"]}
investigative_searches = ["ESCU - Get EC2 Instance Details by instanceId", "ESCU - Get EC2 Launch Details", "ESCU - Investigate AWS activities via region name", "ESCU - Get Notable Info", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History"]
investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Investigate AWS activities via region name", "ESCU - Get EC2 Launch Details", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Notable History", "ESCU - Get Notable Info"]
support_searches = []
data_models = []
providing_technologies = none
@@ -53,7 +53,7 @@ version = 2
reference = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"]
detection_searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule"]
mappings = {"cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC"]}
investigative_searches = ["ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Notable Info", "ESCU - Get DNS Server History for a host", "ESCU - Get Process Info", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Risk Modifiers For User", "ESCU - Get DNS traffic ratio", "ESCU - Get Authentication Logs For Endpoint", "ESCU - AWS Network ACL Details from ID", "ESCU - Get Notable History", "ESCU - Get Process Responsible For The DNS Traffic"]
investigative_searches = ["ESCU - Get DNS traffic ratio", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - AWS Investigate User Activities By ARN", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get All AWS Activity From IP Address", "ESCU - AWS Network ACL Details from ID"]
support_searches = []
data_models = []
providing_technologies = none
@@ -69,7 +69,7 @@ version = 1
reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
detection_searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule"]
mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]}
investigative_searches = ["ESCU - Get All AWS Activity From Country", "ESCU - Get All AWS Activity From Region", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get All AWS Activity From City"]
investigative_searches = ["ESCU - Get All AWS Activity From City", "ESCU - Get All AWS Activity From Country", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get All AWS Activity From Region"]
support_searches = []
data_models = []
providing_technologies = none
@@ -105,7 +105,7 @@ version = 1
reference = ["https://www.sans.org/media/critical-security-controls/critical-controls-poster-2016.pdf"]
detection_searches = ["ESCU - Detect Excessive Account Lockouts From Endpoint - Rule", "ESCU - Detect Excessive User Account Lockouts - Rule", "ESCU - Identify New User Accounts - Rule", "ESCU - Short Lived Windows Accounts - Rule"]
mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078", "T1136"], "nist": ["PR.IP"]}
investigative_searches = ["ESCU - Get Logon Rights Modifications For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Logon Rights Modifications For User", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
investigative_searches = ["ESCU - Get Logon Rights Modifications For User", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Logon Rights Modifications For Endpoint", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint"]
support_searches = []
data_models = ["Change"]
providing_technologies = none
@@ -121,7 +121,7 @@ version = 1
reference = ["https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"]
detection_searches = ["ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule"]
mappings = {"cis20": ["CIS 12", "CIS 18", "CIS 3", "CIS 4"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation"], "mitre_attack": ["T1082"], "nist": ["DE.AE", "DE.CM", "ID.RA", "PR.IP", "PR.MA", "PR.PT", "RS.MI"]}
investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Investigate Web POSTs From src", "ESCU - Get Notable Info", "ESCU - Investigate Suspicious Strings in HTTP Header", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web POSTs From src", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Suspicious Strings in HTTP Header"]
support_searches = []
data_models = ["Endpoint"]
providing_technologies = none
@@ -150,7 +150,7 @@ version = 1
reference = ["https://www.cisecurity.org/controls/inventory-of-authorized-and-unauthorized-devices/"]
detection_searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule"]
mappings = {"cis20": ["CIS 1"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.DS"]}
investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address"]
investigative_searches = ["ESCU - Get Notable History", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address", "ESCU - Get Notable Info"]
support_searches = []
data_models = ["Network_Sessions"]
providing_technologies = none
@@ -166,7 +166,7 @@ version = 1
reference = ["https://www.zerofox.com/blog/what-is-digital-risk-monitoring/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"]
detection_searches = ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule"]
mappings = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives", "Delivery"], "nist": ["PR.IP"]}
investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Emails From Specific Sender", "ESCU - Get Risk Modifiers For User", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Email Info", "ESCU - Investigate Web Activity From Host"]
investigative_searches = ["ESCU - Get Emails From Specific Sender", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Email Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Web Activity From Host"]
support_searches = []
data_models = ["Email", "Network_Resolution", "Web"]
providing_technologies = none
@@ -184,7 +184,7 @@ version = 1
reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
detection_searches = ["ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Cloud Compute Instance Started In Previously Unused Region - Rule"]
mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.AE", "DE.DP", "ID.AM"]}
investigative_searches = ["ESCU - Get EC2 Instance Details by instanceId", "ESCU - Get EC2 Launch Details", "ESCU - Investigate AWS activities via region name", "ESCU - Investigate User Activities In Single Cloud Region", "ESCU - Get Notable Info", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Investigate Cloud Compute Instance Activities", "ESCU - Investigate User Activities In All Cloud Regions", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History"]
investigative_searches = ["ESCU - Investigate User Activities In Single Cloud Region", "ESCU - Get User Information from Identity Table", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Investigate AWS activities via region name", "ESCU - Get EC2 Launch Details", "ESCU - Investigate User Activities In All Cloud Regions", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Investigate Cloud Compute Instance Activities", "ESCU - Get Notable History", "ESCU - Get Notable Info"]
support_searches = []
data_models = ["Cloud_Infrastructure"]
providing_technologies = none
@@ -203,7 +203,7 @@ version = 1
reference = ["https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/", "https://objective-see.com/blog/blog_0x2A.html", "https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/"]
detection_searches = ["ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule"]
mappings = {"cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Command and Control"], "nist": ["DE.DP", "PR.PT"]}
investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Network Traffic From src ip", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From src ip"]
investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From src ip", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Network Traffic From src ip", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Authentication Logs For Endpoint"]
support_searches = []
data_models = []
providing_technologies = none
@@ -221,7 +221,7 @@ version = 1
reference = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"]
detection_searches = ["ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule"]
mappings = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1043", "T1074", "T1114"], "nist": ["DE.AE", "DE.CM", "PR.PT"]}
investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Endpoint", "Network_Traffic"]
providing_technologies = none
@@ -239,7 +239,7 @@ version = 1
reference = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"]
detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"]
mappings = {"cis20": ["CIS 1", "CIS 11", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery"], "mitre_attack": ["T1043", "T1048", "T1095"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get DNS Server History for a host", "ESCU - Get Process Info", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Risk Modifiers For User", "ESCU - Get DNS traffic ratio", "ESCU - Get Authentication Logs For Endpoint", "ESCU - AWS Network ACL Details from ID", "ESCU - Get Notable History", "ESCU - Get Process Responsible For The DNS Traffic"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get DNS traffic ratio", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - AWS Investigate User Activities By ARN", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get All AWS Activity From IP Address", "ESCU - AWS Network ACL Details from ID"]
support_searches = []
data_models = ["Network_Resolution", "Network_Traffic"]
providing_technologies = none
@@ -289,7 +289,7 @@ version = 3
reference = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"]
detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"]
mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1003", "T1064", "T1086"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP"]}
investigative_searches = ["ESCU - Investigate Failed Logins for Multiple Destinations", "ESCU - Investigate Pass the Ticket Attempts", "ESCU - Investigate Pass the Hash Attempts", "ESCU - Investigate Previous Unseen User"]
investigative_searches = ["ESCU - Investigate Pass the Ticket Attempts", "ESCU - Investigate Previous Unseen User", "ESCU - Investigate Failed Logins for Multiple Destinations", "ESCU - Investigate Pass the Hash Attempts"]
support_searches = []
data_models = ["Endpoint"]
providing_technologies = none
@@ -307,7 +307,7 @@ version = 2
reference = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"]
detection_searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Name Used by Dragonfly Threat Actors - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule"]
mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 2", "CIS 3", "CIS 5", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1031", "T1043", "T1050", "T1053", "T1059", "T1064", "T1078", "T1086", "T1089", "T1103", "T1112", "T1131"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get Process File Activity", "ESCU - Get Process Information For Port Activity", "ESCU - Get Registry Activities", "ESCU - Get User Information from Identity Table", "ESCU - Get Process Registry Activity", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From Host"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Process Registry Activity", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Registry Activities", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process File Activity"]
support_searches = []
data_models = ["Endpoint", "Network_Traffic"]
providing_technologies = none
@@ -326,7 +326,7 @@ version = 1
reference = ["https://www.us-cert.gov/ncas/alerts/TA13-088A", "https://www.imperva.com/learn/application-security/dns-amplification/"]
detection_searches = ["ESCU - Large Volume of DNS ANY Queries - Rule"]
mappings = {"cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.IP"]}
investigative_searches = ["ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For User"]
investigative_searches = ["ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Get Notable Info"]
support_searches = []
data_models = ["Network_Resolution"]
providing_technologies = none
@@ -367,7 +367,7 @@ version = 1
reference = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"]
detection_searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule"]
mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1043"], "nist": ["DE.AE", "DE.CM", "PR.DS", "PR.PT"]}
investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get DNS Server History for a host", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get DNS traffic ratio", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Responsible For The DNS Traffic"]
investigative_searches = ["ESCU - Get DNS traffic ratio", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Change_Analysis", "Network_Resolution"]
providing_technologies = none
@@ -383,7 +383,7 @@ version = 2
reference = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"]
detection_searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1031", "T1050", "T1059", "T1089", "T1112"], "nist": ["DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From Host"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Endpoint"]
providing_technologies = none
@@ -399,7 +399,7 @@ version = 2
reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"]
detection_searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule"]
mappings = {"cis20": ["CIS 13", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1041"], "nist": ["DE.CM", "DE.DP", "PR.IP"]}
investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get DNS Server History for a host", "ESCU - Get Risk Modifiers For User", "ESCU - Get DNS traffic ratio", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From src ip", "ESCU - Get Process Responsible For The DNS Traffic"]
investigative_searches = ["ESCU - Get DNS traffic ratio", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From src ip", "ESCU - Get User Information from Identity Table", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint"]
support_searches = []
data_models = ["Network_Resolution", "Web"]
providing_technologies = none
@@ -415,7 +415,7 @@ version = 1
reference = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"]
detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"]
mappings = {"cis20": ["CIS 12", "CIS 2", "CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exploitation", "Installation"], "mitre_attack": ["T1043", "T1059", "T1072", "T1087", "T1103", "T1131"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get Process Information For Port Activity", "ESCU - Get Registry Activities", "ESCU - Get User Information from Identity Table", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From Host"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Process Information For Port Activity", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Registry Activities", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Email", "Endpoint", "Network_Traffic"]
providing_technologies = none
@@ -433,7 +433,7 @@ version = 2
reference = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"]
detection_searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious File Write - Rule"]
mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1043", "T1059", "T1064", "T1076"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get Process Information For Port Activity", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get DNS Server History for a host", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For User", "ESCU - Get DNS traffic ratio", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Responsible For The DNS Traffic"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get DNS traffic ratio", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Notable History", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Endpoint", "Network_Resolution", "Network_Traffic"]
providing_technologies = none
@@ -452,7 +452,7 @@ version = 1
reference = ["https://blog.malwarebytes.com/cybercrime/2016/09/hosts-file-hijacks/"]
detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Windows hosts file modification - Rule"]
mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get DNS Server History for a host", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint"]
support_searches = []
data_models = ["Network_Resolution"]
providing_technologies = none
@@ -468,7 +468,7 @@ version = 1
reference = ["http://www.deependresearch.org/2016/04/jboss-exploits-view-from-victim.html"]
detection_searches = ["ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule"]
mappings = {"cis20": ["CIS 18"], "kill_chain_phases": ["Delivery", "Reconnaissance"], "mitre_attack": ["T1082"], "nist": ["DE.CM"]}
investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From Host"]
investigative_searches = ["ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Investigate Web Activity From Host"]
support_searches = []
data_models = ["Web"]
providing_technologies = none
@@ -498,7 +498,7 @@ version = 1
reference = ["https://github.com/splunk/cloud-datamodel-security-research"]
detection_searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule"]
mappings = {"kill_chain_phases": ["Reconnaissance"]}
investigative_searches = ["ESCU - Amazon EKS Kubernetes activity by src ip", "ESCU - GCP Kubernetes activity by src ip", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
investigative_searches = ["ESCU - Amazon EKS Kubernetes activity by src ip", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - GCP Kubernetes activity by src ip", "ESCU - Get Notable Info"]
support_searches = []
data_models = []
providing_technologies = none
@@ -514,7 +514,7 @@ version = 2
reference = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"]
detection_searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule"]
mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 9"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053", "T1075", "T1076"], "nist": ["DE.AE", "PR.AC", "PR.IP"]}
investigative_searches = ["ESCU - Get Process Information For Port Activity", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Endpoint", "Network_Traffic"]
providing_technologies = none
@@ -534,7 +534,7 @@ version = 4
reference = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"]
detection_searches = ["ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1064", "T1086"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Endpoint"]
providing_technologies = none
@@ -559,7 +559,7 @@ version = 1
reference = ["https://www.carbonblack.com/2016/03/04/tracking-locky-ransomware-using-carbon-black/"]
detection_searches = ["ESCU - Extended Period Without Successful Netbackup Backups - Rule", "ESCU - Unsuccessful Netbackup backups - Rule"]
mappings = {"cis20": ["CIS 10"], "nist": ["PR.IP"]}
investigative_searches = ["ESCU - Get Risk Modifiers For Endpoint", "ESCU - All backup logs for host", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User"]
investigative_searches = ["ESCU - All backup logs for host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User"]
support_searches = []
data_models = []
providing_technologies = none
@@ -575,7 +575,7 @@ version = 1
reference = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"]
detection_searches = ["ESCU - Prohibited Software On Endpoint - Rule"]
mappings = {"cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.DS"]}
investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From Host"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Endpoint"]
providing_technologies = none
@@ -592,7 +592,7 @@ version = 1
reference = ["https://learn.cisecurity.org/20-controls-download"]
detection_searches = ["ESCU - No Windows Updates in a time frame - Rule"]
mappings = {"cis20": ["CIS 18"], "nist": ["PR.MA"]}
investigative_searches = ["ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info"]
investigative_searches = ["ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info"]
support_searches = []
data_models = ["Updates"]
providing_technologies = none
@@ -610,7 +610,7 @@ version = 1
reference = ["https://technet.microsoft.com/library/bb490939.aspx", "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"]
detection_searches = ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule"]
mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059", "T1089"], "nist": ["DE.CM", "PR.PT"]}
investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From Host"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Endpoint"]
providing_technologies = none
@@ -627,7 +627,7 @@ version = 2
reference = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"]
detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1031", "T1050", "T1059", "T1064", "T1089"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From Host"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Endpoint"]
providing_technologies = none
@@ -670,7 +670,7 @@ version = 1
reference = ["https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/", "http://blog.amossys.fr/badflick-is-not-so-bad.html"]
detection_searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1059", "T1064", "T1086", "T1103", "T1131"], "nist": ["DE.AE", "DE.CM", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get Registry Activities", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From Host"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Registry Activities", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Endpoint"]
providing_technologies = none
@@ -713,7 +713,7 @@ version = 1
reference = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"]
detection_searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"]
mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery"], "mitre_attack": ["T1043", "T1048"], "nist": ["DE.AE", "DE.CM", "PR.AC"]}
investigative_searches = ["ESCU - Get Process Information For Port Activity", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get DNS Server History for a host", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Network_Resolution", "Network_Traffic"]
providing_technologies = none
@@ -729,7 +729,7 @@ version = 1
reference = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
detection_searches = ["ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Windows Event Log Cleared - Rule"]
mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 3", "CIS 5", "CIS 6", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery"], "mitre_attack": ["T1036", "T1043", "T1047", "T1048", "T1053", "T1070", "T1103", "T1131"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get Process Information For Port Activity", "ESCU - Get Registry Activities", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From Host"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Process Information For Port Activity", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Registry Activities", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Endpoint", "Network_Traffic"]
providing_technologies = none
@@ -745,7 +745,7 @@ version = 1
reference = ["https://www.fireeye.com/blog/executive-perspective/2015/09/the_new_route_toper.html", "https://www.cisco.com/c/en/us/about/security-center/event-response/synful-knock.html"]
detection_searches = ["ESCU - Detect New Login Attempts to Routers - Rule"]
mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.IP"]}
investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint"]
support_searches = []
data_models = ["Authentication"]
providing_technologies = none
@@ -762,7 +762,7 @@ version = 1
reference = ["https://capec.mitre.org/data/definitions/66.html", "https://www.incapsula.com/web-application-security/sql-injection.html"]
detection_searches = ["ESCU - SQL Injection with Long URLs - Rule"]
mappings = {"cis20": ["CIS 18"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1043"], "nist": ["DE.CM"]}
investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info"]
investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info"]
support_searches = []
data_models = ["Web"]
providing_technologies = none
@@ -779,7 +779,7 @@ version = 1
reference = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"]
detection_searches = ["ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule"]
mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 16", "CIS 18", "CIS 2", "CIS 3", "CIS 4", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Installation", "Reconnaissance"], "mitre_attack": ["T1059", "T1076", "T1082"], "nist": ["DE.AE", "DE.CM", "ID.AM", "ID.RA", "PR.AC", "PR.DS", "PR.IP", "PR.MA", "PR.PT"]}
investigative_searches = ["ESCU - Get Process Information For Port Activity", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From Host"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Process Information For Port Activity", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Endpoint", "Network_Traffic", "Web"]
providing_technologies = none
@@ -800,7 +800,7 @@ version = 1
reference = ["https://meltdownattack.com/"]
detection_searches = ["ESCU - Spectre and Meltdown Vulnerable Systems - Rule"]
mappings = {"cis20": ["CIS 4"], "nist": ["DE.CM"]}
investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint"]
support_searches = []
data_models = ["Vulnerabilities"]
providing_technologies = none
@@ -816,7 +816,7 @@ version = 1
reference = ["http://www.splunk.com/view/SP-CAAAPQ6#announce", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4859"]
detection_searches = ["ESCU - Open Redirect in Splunk Web - Rule"]
mappings = {"cis20": ["CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["DE.CM"]}
investigative_searches = ["ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info"]
investigative_searches = ["ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info"]
support_searches = []
data_models = []
providing_technologies = none
@@ -841,7 +841,7 @@ version = 1
reference = ["https://nvd.nist.gov/vuln/detail/CVE-2018-11409", "https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings", "https://www.exploit-db.com/exploits/44865/"]
detection_searches = ["ESCU - Splunk Enterprise Information Disclosure - Rule"]
mappings = {"cis20": ["CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["DE.CM"]}
investigative_searches = ["ESCU - Get Notable Info", "ESCU - Investigate Network Traffic From src ip", "ESCU - Investigate Web Activity From src ip", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
investigative_searches = ["ESCU - Investigate Web Activity From src ip", "ESCU - Investigate Network Traffic From src ip", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info"]
support_searches = []
data_models = []
providing_technologies = none
@@ -860,7 +860,7 @@ version = 1
reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
detection_searches = ["ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule"]
mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.AE", "DE.DP", "ID.AM"]}
investigative_searches = ["ESCU - Get EC2 Instance Details by instanceId", "ESCU - Get EC2 Launch Details", "ESCU - Investigate AWS activities via region name", "ESCU - Get Notable Info", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History"]
investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Investigate AWS activities via region name", "ESCU - Get EC2 Launch Details", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Notable History", "ESCU - Get Notable Info"]
support_searches = []
data_models = []
providing_technologies = none
@@ -892,7 +892,7 @@ version = 2
reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"]
detection_searches = ["ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule"]
mappings = {"cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM", "DE.DP", "PR.AC", "PR.DS"]}
investigative_searches = ["ESCU - Investigate AWS activities via region name", "ESCU - AWS S3 Bucket details via bucketName", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Notable Info", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History"]
investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - AWS S3 Bucket details via bucketName", "ESCU - Get All AWS Activity From IP Address"]
support_searches = []
data_models = []
providing_technologies = none
@@ -910,7 +910,7 @@ version = 1
reference = ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"]
detection_searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule"]
mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Command and Control"], "nist": ["PR.AC"]}
investigative_searches = ["ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Notable Info", "ESCU - Get DNS Server History for a host", "ESCU - Get Process Info", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Risk Modifiers For User", "ESCU - Get DNS traffic ratio", "ESCU - Get Authentication Logs For Endpoint", "ESCU - AWS Network ACL Details from ID", "ESCU - Get Notable History", "ESCU - Get Process Responsible For The DNS Traffic"]
investigative_searches = ["ESCU - Get DNS traffic ratio", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - AWS Investigate User Activities By ARN", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get All AWS Activity From IP Address", "ESCU - AWS Network ACL Details from ID"]
support_searches = []
data_models = []
providing_technologies = none
@@ -929,7 +929,7 @@ version = 2
reference = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"]
detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1036", "T1059", "T1064"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get Registry Activities", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From Host"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Registry Activities", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Endpoint"]
providing_technologies = none
@@ -945,7 +945,7 @@ version = 1
reference = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"]
detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule"]
mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1043", "T1048"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get DNS Server History for a host", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get DNS traffic ratio", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Responsible For The DNS Traffic"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get DNS traffic ratio", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Network_Resolution"]
providing_technologies = none
@@ -961,7 +961,7 @@ version = 1
reference = ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"]
detection_searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"]
mappings = {"cis20": ["CIS 12", "CIS 3", "CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["DE.AE", "PR.IP"]}
investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Emails From Specific Sender", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Email Info", "ESCU - Investigate Web Activity From Host"]
investigative_searches = ["ESCU - Get Emails From Specific Sender", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Email Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Web Activity From Host"]
support_searches = []
data_models = ["Email", "UEBA"]
providing_technologies = none
@@ -981,7 +981,7 @@ version = 1
reference = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5", "https://attack.mitre.org/wiki/Technique/T1170"]
detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect mshta exe running scripts in command-line arguments - Rule", "ESCU - Registry Keys Used For Persistence - Rule"]
mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1059", "T1103", "T1131"], "nist": ["DE.AE", "DE.CM", "PR.PT"]}
investigative_searches = ["ESCU - Get Registry Activities", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From Host"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Registry Activities", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Endpoint"]
providing_technologies = none
@@ -999,7 +999,7 @@ version = 1
reference = ["https://attack.mitre.org/wiki/Technique/T1078", "https://owasp.org/www-community/attacks/Credential_stuffing", "https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work"]
detection_searches = ["ESCU - Multiple Okta Users With Invalid Credentails From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule"]
mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078"], "nist": ["DE.CM"]}
investigative_searches = ["ESCU - Investigate Okta Activity by IP Address", "ESCU - Investigate Okta Activity by app", "ESCU - Investigate User Activities In Okta"]
investigative_searches = ["ESCU - Investigate User Activities In Okta", "ESCU - Investigate Okta Activity by app", "ESCU - Investigate Okta Activity by IP Address"]
support_searches = []
data_models = []
providing_technologies = none
@@ -1017,7 +1017,7 @@ version = 2
reference = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"]
detection_searches = ["ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047", "T1084"], "nist": ["PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Endpoint"]
providing_technologies = none
@@ -1035,7 +1035,7 @@ version = 1
reference = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"]
detection_searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1015", "T1042", "T1103", "T1112", "T1131", "T1138"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get Registry Activities", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From Host"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Registry Activities", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Endpoint"]
providing_technologies = none
@@ -1053,7 +1053,7 @@ version = 1
reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
detection_searches = ["ESCU - EC2 Instance Modified With Previously Unseen User - Rule"]
mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]}
investigative_searches = ["ESCU - Get EC2 Instance Details by instanceId", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Notable History"]
investigative_searches = ["ESCU - AWS Investigate User Activities By ARN", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Get Notable History"]
support_searches = []
data_models = []
providing_technologies = none
@@ -1070,7 +1070,7 @@ version = 2
reference = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"]
detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
mappings = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1015", "T1036", "T1085"], "nist": ["DE.CM", "ID.AM", "PR.DS", "PR.PT"]}
investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From Host"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Endpoint"]
providing_technologies = none
@@ -1088,7 +1088,7 @@ version = 1
reference = ["https://www.monkey.org/~dugsong/dsniff/"]
detection_searches = ["ESCU - Protocols passing authentication in cleartext - Rule"]
mappings = {"cis20": ["CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.DS"]}
investigative_searches = ["ESCU - Get Process Information For Port Activity", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info"]
support_searches = []
data_models = ["Network_Traffic"]
providing_technologies = none
@@ -1125,7 +1125,7 @@ version = 1
reference = ["https://attack.mitre.org/wiki/Defense_Evasion"]
detection_searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Reg exe Process - Rule"]
mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1089", "T1112"], "nist": ["DE.CM", "PR.PT"]}
investigative_searches = ["ESCU - Get Registry Activities", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Registry Activities", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Endpoint"]
providing_technologies = none
@@ -1141,7 +1141,7 @@ version = 1
reference = ["https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/", "https://attack.mitre.org/wiki/Technique/T1042"]
detection_searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Suspicious Changes to File Associations - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1042"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get Registry Activities", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Registry Activities", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Endpoint"]
providing_technologies = none
@@ -1161,7 +1161,7 @@ version = 2
reference = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://zeltser.com/security-incident-log-review-checklist/", "http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html"]
detection_searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule"]
mappings = {"cis20": ["CIS 10", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From Host"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Endpoint"]
providing_technologies = none
@@ -1178,7 +1178,7 @@ version = 2
reference = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"]
detection_searches = ["ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1031", "T1050", "T1053", "T1089", "T1103", "T1131", "T1138"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get Registry Activities", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From Host"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Registry Activities", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Endpoint"]
providing_technologies = none
@@ -1194,7 +1194,7 @@ version = 2
reference = ["https://attack.mitre.org/tactics/TA0004/"]
detection_searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule"]
mappings = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1015", "T1068"], "nist": ["DE.CM", "ID.AM", "PR.DS", "PR.PT"]}
investigative_searches = ["ESCU - Get Registry Activities", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From Host"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Registry Activities", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Endpoint"]
providing_technologies = none
@@ -1210,7 +1210,7 @@ version = 3
reference = ["https://attack.mitre.org/wiki/Technique/T1050", "https://attack.mitre.org/wiki/Technique/T1031"]
detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1031", "T1050", "T1089"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info"]
support_searches = []
data_models = ["Endpoint"]
providing_technologies = none
package/default/macros.conf
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security-content
# On Date: 2020-05-11T12:39:19 UTC
# On Date: 2020-05-11T15:39:38 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
package/default/savedsearches.conf
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security-content
# On Date: 2020-05-11T12:39:19 UTC
# On Date: 2020-05-11T15:39:38 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
package/default/transforms.conf
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security-content
# On Date: 2020-05-11T12:39:19 UTC
# On Date: 2020-05-11T15:39:38 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
package/default/use_case_library.conf
+253 -253
View File
File diff suppressed because it is too large Load Diff