RBA support take 4

detections/endpoint/malicious_powershell_process___encoded_command.yml

@@ -56,3 +56,18 @@ tags:
   - Processes.dest
   - Processes.process_id
   security_domain: endpoint
+  impact: 70
+  confidence: 50
+  risk_score: 35
+  context:
+  - Source: Endpoint
+  - Stage: Initial Access
+  - Stage: Execution
+  - Stage: Defense Evasion
+  message: Powershell.exe running potentially malicious encodede commands on $dest
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+

detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml

@@ -2,7 +2,7 @@ name: Malicious PowerShell Process - Execution Policy Bypass
 id: 9be56c82-b1cc-4318-87eb-d138afaaca39
 version: 4
 date: '2020-07-21'
-author: Rico Valdez, Splunk
+author: Rico Valdez, Mauricio Velazco, Splunk
 type: batch
 datamodel:
 - Endpoint
@@ -59,3 +59,17 @@ tags:
   - Processes.user
   - Processes.dest
   security_domain: endpoint
+  impact: 70
+  confidence: 60
+  risk_score: 42
+  context:
+  - Source: Endpoint
+  - Stage: Initial Access
+  - Stage: Execution
+  - Stage: Defense Evasion
+  message: PowerShell local execution policy bypass attempt on $dest
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml

@@ -57,3 +57,17 @@ tags:
   - Processes.parent_process_name
   - Processes.dest
   security_domain: endpoint
+  impact: 70
+  confidence: 60
+  risk_score: 42
+  context:
+  - Source: Endpoint
+  - Stage: Initial Access
+  - Stage: Execution
+  - Stage: Defense Evasion
+  message: Powershell.exe running with potential obfuscated arguments on $dest
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/modification_of_wallpaper.yml

@@ -49,3 +49,16 @@ tags:
   - process_id
   - user_id
   security_domain: endpoint
+  impact: 60
+  confidence: 90
+  risk_score: 54
+  context:
+  - Source: Endpoint
+  - Stage: Execution
+  message: Wallpaper modification on $dest
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  

detections/endpoint/modify_acl_permission_to_files_or_folder.yml

@@ -50,3 +50,15 @@ tags:
   - Processes.process
   - Processes.process_id
   security_domain: endpoint
+  impact: 40
+  confidence: 80
+  risk_score: 32
+  context:
+  - Source: Endpoint
+  - Stage: Defense Evasion
+  message: Suspicious ACL permission modification on $dest
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/monitor_registry_keys_for_print_monitors.yml

@@ -56,3 +56,17 @@ tags:
   - Registry.user
   - Registry.registry_value_name
   security_domain: endpoint
+  impact: 80
+  confidence: 80
+  risk_score: 64
+  context:
+  - Source: Endpoint
+  - Stage: Execution
+  - Stage: Persistence
+  - Stage: Privilege Escalation
+  message: 
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml

@@ -63,3 +63,16 @@ tags:
   - Account_Name
   - Client_Address
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source: Endpoint
+  - Stage: Initial Access
+  - Stage: Privilege Escalation
+  message: Potential Kerberos based password spraying attack from $Client_Address
+  observable:
+  - name: Client_Address
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml

@@ -63,3 +63,16 @@ tags:
   - Account_Name
   - Client_Address
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source: Endpoint
+  - Stage: Initial Access
+  - Stage: Privilege Escalation
+  message: Potential Kerberos based password spraying attack from $Client_Address
+  observable:
+  - name: Client_Address
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml

@@ -67,3 +67,16 @@ tags:
   - Logon_Account
   - Source_Workstation
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source: Endpoint
+  - Stage: Initial Access
+  - Stage: Privilege Escalation
+  message: Potential NTLM based password spraying attack from $Source_Workstation
+  observable:
+  - name: Source_Workstation
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml

@@ -68,3 +68,16 @@ tags:
   - Account_Name
   - ComputerName
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source: Endpoint
+  - Stage: Initial Access
+  - Stage: Privilege Escalation
+  message: Potential password spraying attack from $ComputerName
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml

@@ -63,3 +63,16 @@ tags:
   - Account_Name
   - Client_Address
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source: Endpoint
+  - Stage: Initial Access
+  - Stage: Privilege Escalation
+  message: Potential Kerberos based password spraying attack from $Client_Address
+  observable:
+  - name: Client_Address
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml

@@ -65,3 +65,16 @@ tags:
   - Logon_Account
   - Source_Workstation
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source: Endpoint
+  - Stage: Initial Access
+  - Stage: Privilege Escalation
+  message: Potential NTLM based password spraying attack from $Source_Workstation
+  observable:
+  - name: Source_Workstation
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml

@@ -69,3 +69,16 @@ tags:
   - Account_Name
   - ComputerName
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  risk_score: 49
+  context:
+  - Source: Endpoint
+  - Stage: Initial Access
+  - Stage: Privilege Escalation
+  message: Potential password spraying attack from $ComputerName
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim