diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index 962b5bcb15..987653018f 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -56,3 +56,18 @@ tags: - Processes.dest - Processes.process_id security_domain: endpoint + impact: 70 + confidence: 50 + risk_score: 35 + context: + - Source: Endpoint + - Stage: Initial Access + - Stage: Execution + - Stage: Defense Evasion + message: Powershell.exe running potentially malicious encodede commands on $dest + observable: + - name: dest + type: Endpoint + role: + - Victim + diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index 2446a119a8..70b2534c4b 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -2,7 +2,7 @@ name: Malicious PowerShell Process - Execution Policy Bypass id: 9be56c82-b1cc-4318-87eb-d138afaaca39 version: 4 date: '2020-07-21' -author: Rico Valdez, Splunk +author: Rico Valdez, Mauricio Velazco, Splunk type: batch datamodel: - Endpoint @@ -59,3 +59,17 @@ tags: - Processes.user - Processes.dest security_domain: endpoint + impact: 70 + confidence: 60 + risk_score: 42 + context: + - Source: Endpoint + - Stage: Initial Access + - Stage: Execution + - Stage: Defense Evasion + message: PowerShell local execution policy bypass attempt on $dest + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml index 9da3b6a47f..f084ea1814 100644 --- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml +++ b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml @@ -57,3 +57,17 @@ tags: - Processes.parent_process_name - Processes.dest security_domain: endpoint + impact: 70 + confidence: 60 + risk_score: 42 + context: + - Source: Endpoint + - Stage: Initial Access + - Stage: Execution + - Stage: Defense Evasion + message: Powershell.exe running with potential obfuscated arguments on $dest + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml index 2305d630fb..2268a0d124 100644 --- a/detections/endpoint/modification_of_wallpaper.yml +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -49,3 +49,16 @@ tags: - process_id - user_id security_domain: endpoint + impact: 60 + confidence: 90 + risk_score: 54 + context: + - Source: Endpoint + - Stage: Execution + message: Wallpaper modification on $dest + observable: + - name: dest + type: Endpoint + role: + - Victim + \ No newline at end of file diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml index 34433bd3d2..d875ccf274 100644 --- a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml +++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml @@ -50,3 +50,15 @@ tags: - Processes.process - Processes.process_id security_domain: endpoint + impact: 40 + confidence: 80 + risk_score: 32 + context: + - Source: Endpoint + - Stage: Defense Evasion + message: Suspicious ACL permission modification on $dest + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index 836a01c18d..d6479b178e 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -56,3 +56,17 @@ tags: - Registry.user - Registry.registry_value_name security_domain: endpoint + impact: 80 + confidence: 80 + risk_score: 64 + context: + - Source: Endpoint + - Stage: Execution + - Stage: Persistence + - Stage: Privilege Escalation + message: + observable: + - name: dest + type: Endpoint + role: + - Victim diff --git a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml index bf8a988ea7..485bd0cd81 100644 --- a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -63,3 +63,16 @@ tags: - Account_Name - Client_Address security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source: Endpoint + - Stage: Initial Access + - Stage: Privilege Escalation + message: Potential Kerberos based password spraying attack from $Client_Address + observable: + - name: Client_Address + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml index 7b786d699f..bddde45709 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -63,3 +63,16 @@ tags: - Account_Name - Client_Address security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source: Endpoint + - Stage: Initial Access + - Stage: Privilege Escalation + message: Potential Kerberos based password spraying attack from $Client_Address + observable: + - name: Client_Address + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml index a0d0f5fae7..2c958e6615 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml @@ -67,3 +67,16 @@ tags: - Logon_Account - Source_Workstation security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source: Endpoint + - Stage: Initial Access + - Stage: Privilege Escalation + message: Potential NTLM based password spraying attack from $Source_Workstation + observable: + - name: Source_Workstation + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml index f55f42d909..7539c12f93 100644 --- a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml +++ b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml @@ -68,3 +68,16 @@ tags: - Account_Name - ComputerName security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source: Endpoint + - Stage: Initial Access + - Stage: Privilege Escalation + message: Potential password spraying attack from $ComputerName + observable: + - name: ComputerName + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml index 4c2e2a99dc..54e5e88492 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -63,3 +63,16 @@ tags: - Account_Name - Client_Address security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source: Endpoint + - Stage: Initial Access + - Stage: Privilege Escalation + message: Potential Kerberos based password spraying attack from $Client_Address + observable: + - name: Client_Address + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml index 274a1842c1..acdca09d3a 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml @@ -65,3 +65,16 @@ tags: - Logon_Account - Source_Workstation security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source: Endpoint + - Stage: Initial Access + - Stage: Privilege Escalation + message: Potential NTLM based password spraying attack from $Source_Workstation + observable: + - name: Source_Workstation + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml index d55bdf301c..f8beee9a98 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml @@ -69,3 +69,16 @@ tags: - Account_Name - ComputerName security_domain: endpoint + impact: 70 + confidence: 70 + risk_score: 49 + context: + - Source: Endpoint + - Stage: Initial Access + - Stage: Privilege Escalation + message: Potential password spraying attack from $ComputerName + observable: + - name: ComputerName + type: Endpoint + role: + - Victim \ No newline at end of file