Branch was auto-updated.

2026-06-08 17:32:49 +00:00 · 2021-10-14 15:45:08 -07:00
parent b90aa993cf d80e9fa3da
commit 8cb34cee47
766 changed files with 4654 additions and 4219 deletions
@@ -10,6 +10,8 @@ import datetime
 from stix2 import FileSystemSource
 from stix2 import Filter

+
+
 def get_all_techniques(projects_path):
    path_cti = path.join(projects_path,'cti/enterprise-attack')
    fs = FileSystemSource(path_cti)
@@ -109,11 +111,6 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de
                        sto_to_kill_chain_phases[story] = set(detection['tags']['kill_chain_phases'])

                if 'mitre_attacks' in detection:
-                    if story in sto_to_mitre_attacks.keys():
-                        for mitre_attack in detection['mitre_attacks']:
-                            if mitre_attack not in sto_to_mitre_attacks[story]:
-                                sto_to_mitre_attacks[story].append(mitre_attack)
-                    else:
                        sto_to_mitre_attacks[story] = detection['mitre_attacks']

    # add the enrich objects to the story
@@ -198,14 +195,6 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de
            f.write(output)
        messages.append("doc_gen.py wrote _page for: {0} structure to: {1}".format(category['name'], output_path))

-    # write index updated metrics
-    template = j2_env.get_template('doc_index_markdown.j2')
-    output_path = path.join(OUTPUT_DIR + '/index.markdown')
-    output = template.render(detection_count=len(sorted_detections), story_count=len(sorted_stories))
-    with open(output_path, 'w', encoding="utf-8") as f:
-        f.write(output)
-    messages.append("doc_gen.py wrote site index page to: {0}".format(output_path))
-
    # write stories listing markdown
    template = j2_env.get_template('doc_story_page_markdown.j2')
    output_path = path.join(OUTPUT_DIR + '/_pages/stories.md')
@@ -329,6 +318,71 @@ def generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, messag
    messages.append("doc_gen.py wrote {0} detections documentation in mediawiki to: {1}".format(len(detections),output_path))

    return sorted_detections, messages
+
+def generate_doc_playbooks(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, sorted_detections, messages, VERBOSE):
+    manifest_files = []
+    for root, dirs, files in walk(REPO_PATH + '/playbooks/'):
+        for file in files:
+            if file.endswith(".yml"):
+                manifest_files.append((path.join(root, file)))
+
+    playbooks = []
+    for manifest_file in manifest_files:
+        detection_yaml = dict()
+        if VERBOSE:
+            print("processing manifest {0}".format(manifest_file))
+
+        with open(manifest_file, 'r') as stream:
+            try:
+                object = list(yaml.safe_load_all(stream))[0]
+            except yaml.YAMLError as exc:
+                print(exc)
+                print("Error reading {0}".format(manifest_file))
+                sys.exit(1)
+
+        playbooks.append(object)
+
+    sorted_playbooks = sorted(playbooks, key=lambda i: i['name'])
+
+    j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), # nosemgrep
+                             trim_blocks=False, autoescape=True)
+
+    # write markdown
+    template = j2_env.get_template('doc_playbooks_markdown.j2')
+    for playbook in sorted_playbooks:
+        file_name = playbook['name'].lower().replace(" ","_") + '.md'
+        output_path = path.join(OUTPUT_DIR + '/_playbooks/' + file_name)
+        output = template.render(playbook=playbook, detections=sorted_detections, time=datetime.datetime.now())
+        with open(output_path, 'w', encoding="utf-8") as f:
+            f.write(output)
+    messages.append("doc_gen.py wrote {0} playbook documentation in markdown to: {1}".format(len(sorted_playbooks),OUTPUT_DIR + '/_playbooks/'))
+
+    # write markdown detection page
+    template = j2_env.get_template('doc_playbooks_page_markdown.j2')
+    output_path = path.join(OUTPUT_DIR + '/_pages/playbooks.md')
+    output = template.render(playbooks=sorted_playbooks, detections=sorted_detections, time=datetime.datetime.now())
+    with open(output_path, 'w', encoding="utf-8") as f:
+        f.write(output)
+    messages.append("doc_gen.py wrote playbooks.md page to: {0}".format(output_path))
+
+    return sorted_playbooks, messages
+
+
+def generate_doc_index(OUTPUT_DIR, TEMPLATE_PATH, sorted_detections, sorted_stories, sorted_playbooks, messages, VERBOSE):
+
+    j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), # nosemgrep
+                             trim_blocks=False, autoescape=True)
+
+    # write index updated metrics
+    template = j2_env.get_template('doc_index_markdown.j2')
+    output_path = path.join(OUTPUT_DIR + '/index.markdown')
+    output = template.render(detection_count=len(sorted_detections), story_count=len(sorted_stories), playbook_count=len(sorted_playbooks))
+    with open(output_path, 'w', encoding="utf-8") as f:
+        f.write(output)
+    messages.append("doc_gen.py wrote site index page to: {0}".format(output_path))
+
+    return messages
+
 if __name__ == "__main__":

    # grab arguments
@@ -355,6 +409,8 @@ if __name__ == "__main__":
    messages = []
    sorted_detections, messages = generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, techniques, messages, VERBOSE)
    sorted_stories, messages = generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, techniques, sorted_detections, messages, VERBOSE)
+    sorted_playbooks, messages = generate_doc_playbooks(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, sorted_detections, messages, VERBOSE)
+    messages = generate_doc_index(OUTPUT_DIR, TEMPLATE_PATH, sorted_detections, sorted_stories, sorted_playbooks, messages, VERBOSE)

    # print all the messages from generation
    for m in messages:
@@ -8,12 +8,12 @@ sidebar:
  nav: "detections"
 ---

-| Name    |   Technique |     Tactic   |        Type   |
-| ----------- | ----------- |--------------| --------------|
+| Name    | Technique | Type       |
+| --------| --------- |------------|
 {%- for detection in detections -%}
 {% if detection.mitre_attacks %}
-| [{{ detection.name }}](/{{ detection.kind }}/{{ detection.name | lower | replace(' ', '_') }}/) | {% for attack in detection.mitre_attacks -%} [{{ attack.technique }}](/tags/#{{ attack.technique | lower | replace(" ", "-") }}){% if not loop.last -%}, {% endif -%}{%- endfor %} | [{{ detection.mitre_attacks[0].tactic[0] }}](/tags/#{{ detection.mitre_attacks[0].tactic[0] | lower | replace(" ", "-") }}) | {{ detection.type }} |
+| [{{ detection.name }}](/{{ detection.kind }}/{{ detection.name | lower | replace(' ', '_') }}/) | {% for attack in detection.mitre_attacks -%} [{{ attack.technique }}](/tags/#{{ attack.technique | lower | replace(" ", "-") }}){% if not loop.last -%}, {% endif -%}{%- endfor %} | {{ detection.type }} |
 {%- else %}
-| [{{ detection.name }}]() | None | None | {{ detection.type }} |
+| [{{ detection.name }}]() | None | {{ detection.type }} |
 {%- endif -%}
 {%- endfor -%}
@@ -10,6 +10,7 @@ categories:
  - {{detection.kind|capitalize}}
 last_modified_at: {{detection.date}}
 toc: true
+toc_label: ""
 tags:
  - {{ detection.type }}
 {%- for attack in detection.mitre_attacks %}
@@ -51,8 +52,8 @@ We have not been able to test, simulate or build datasets for it, use at your ow
 {% if detection.mitre_attacks %}
 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 {% for attack in detection.mitre_attacks -%}
 {% if attack.technique_id -%}
 {%- set sub_technique = attack.technique_id.split('.') -%}{%- if sub_technique | length > 1 -%}
@@ -9,7 +9,7 @@ header:
  actions:
    - label: "Download"
      url: "https://splunkbase.splunk.com/app/3449/"
-excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with over 400+ detections for Splunk."
+excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **{{ detection_count }}** detections for Splunk."
 feature_row:
  - image_path: /static/feature_detection.png
    alt: "customizable"
@@ -28,7 +28,7 @@ feature_row:
  - image_path: /static/feature_playbooks.png
    alt: "100% free"
    title: "Playbooks"
-    excerpt: "See all **2** sets of steps 🐾 to automatically response to a threat."
+    excerpt: "See all **{{ playbook_count }}** sets of steps 🐾 to automatically response to a threat."
    url: "/playbooks"
    btn_class: "btn--primary"
    btn_label: "Explore"
@@ -44,9 +44,9 @@ This project gives you access to our repository of Analytic Stories that are sec
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

 ## [Detection Coverage](https://mitremap.splunkresearch.com/) 🗺
-Below is a snapshot in time of what technique we currently have some detection coverage for. The darker the shade of blue the more detections we have for this particular technique. This map is automatically updated on every release and generated from the [generate-coverage-map.py](https://github.com/splunk/security_content/blob/develop/bin/generate-coverage-map.py).
+Below is a snapshot in time of what technique we currently have some detection coverage for. The darker the shade of blue the more detections we have for this particular technique.

-![](mitre-map/coverage.png)
+[![](mitre-map/coverage.png)](https://mitremap.splunkresearch.com/)

 ## View Our Content 🔎

@@ -37,3 +37,10 @@ stories:
      - title: {{ category }}
        url: /stories/{{ category | lower | replace(" ", "_") }}/
    {%- endfor %}
+playbooks:
+  - title: "Type"
+    children:
+      - title: "Response"
+        url: /tags/#response/
+      - title: "Investigation"
+        url: /tags/#investigation/
@@ -0,0 +1,57 @@
+---
+title: "{{playbook.name}}"
+last_modified_at: {{playbook.date}}
+toc: true
+toc_label: ""
+tags:
+  - {{ playbook.type }}
+{%- for product in playbook.tags.product %}
+  - {{ product }}
+{%- endfor -%}
+{%- for app in playbook.app_list %}
+  - {{ app }}
+{%- endfor %}
+---
+
+[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success}
+
+#### Description
+
+{{ playbook.description }}
+
+- **Type**: {{ playbook.type }}
+- **Product**: {{ playbook.tags.product|join(', ') }}
+- **Apps**: {% for app in playbook.app_list %}[{{ app }}](https://splunkbase.splunk.com/apps/#/search/{{ app }}/product/soar){% if not loop.last %}, {% endif %}{%-endfor %}
+- **Last Updated**: {{ playbook.date }}
+- **Author**: {{playbook.author}}
+- **ID**: {{ playbook.id }}
+
+#### Associated Detections
+{% for detection in playbook.tags.detections -%}
+{% for d in detections -%}
+{% if d.name == detection -%}
+* [{{ detection }}](/detections/{{ d.type }}/{{detection|lower|replace(" ", "_")}})
+{% endif %}
+{% endfor %}
+{% endfor %}
+
+#### How To Implement
+{{ playbook.how_to_implement}}
+
+#### Playbooks
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/{{ playbook.name | lower | replace(" ", "_")}}.png)
+
+#### Required field
+{% for field in playbook.tags.playbook_fields -%}
+* {{ field }}
+{% endfor %}
+
+#### Reference
+{% if playbook.references %}
+{% for reference in playbook.references -%}
+* [{{ reference }}]({{ reference }})
+{% endfor %}
+{% endif %}
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/{{ playbook.name | lower | replace (" ", "_") }}.yml) \| *version*: **{{playbook.version}}**
@@ -0,0 +1,15 @@
+---
+title: "Playbooks"
+layout: collection
+author_profile: false
+permalink: /playbooks/
+classes: wide
+sidebar:
+  nav: "playbooks"
+---
+
+| Name    | Detections | Type        |
+| --------| ---------- | ----------- |
+{% for playbook in playbooks -%}
+| [{{ playbook.name }}](/playbooks/{{ playbook.name|lower|replace(' ', '_') }}/)|{% for detection in playbook.tags.detections -%}{% for d in detections -%}{% if d.name == detection -%}[{{ detection }}](/detections/{{ d.type }}/{{detection|lower|replace(" ", "_")}}){% endif -%}{%- endfor -%}{%- endfor -%} | {{ playbook.type }} |
+{%- endfor -%}
@@ -2,6 +2,7 @@
 title: "{{story.name}}"
 last_modified_at: {{story.date}}
 toc: true
+toc_label: ""
 tags:
 {%- for product in story.tags.product %}
  - {{ product }}
@@ -1 +1 @@
-splunkresearch.com
+research.splunk.com
@@ -25,11 +25,11 @@ GEM
    em-websocket (0.5.2)
      eventmachine (>= 0.12.9)
      http_parser.rb (~> 0.6.0)
-    ethon (0.14.0)
+    ethon (0.15.0)
      ffi (>= 1.15.0)
    eventmachine (1.2.7)
    execjs (2.8.1)
-    faraday (1.7.1)
+    faraday (1.8.0)
      faraday-em_http (~> 1.0)
      faraday-em_synchrony (~> 1.0)
      faraday-excon (~> 1.1)
@@ -52,8 +52,8 @@ GEM
    filesize (0.2.0)
    forwardable-extended (2.6.0)
    gemoji (3.0.1)
-    github-pages (219)
-      github-pages-health-check (= 1.17.7)
+    github-pages (220)
+      github-pages-health-check (= 1.17.9)
      jekyll (= 3.9.0)
      jekyll-avatar (= 0.7.0)
      jekyll-coffeescript (= 1.1.1)
@@ -96,7 +96,7 @@ GEM
      nokogiri (>= 1.10.4, < 2.0)
      rouge (= 3.26.0)
      terminal-table (~> 1.4)
-    github-pages-health-check (1.17.7)
+    github-pages-health-check (1.17.9)
      addressable (~> 2.3)
      dnsruby (~> 1.60)
      octokit (~> 4.0)
@@ -242,6 +242,8 @@ GEM
      jekyll-seo-tag (~> 2.1)
    multi_json (1.15.0)
    multipart-post (2.1.1)
+    nokogiri (1.12.5-x86_64-darwin)
+      racc (~> 1.4)
    nokogiri (1.12.5-x86_64-linux)
      racc (~> 1.4)
    octokit (4.21.0)
@@ -278,16 +280,17 @@ GEM
      ethon (>= 0.9.0)
    tzinfo (2.0.4)
      concurrent-ruby (~> 1.0)
-    tzinfo-data (1.2021.1)
+    tzinfo-data (1.2021.3)
      tzinfo (>= 1.0.0)
    unf (0.1.4)
      unf_ext
-    unf_ext (0.0.7.7)
-    unicode-display_width (1.7.0)
+    unf_ext (0.0.8)
+    unicode-display_width (1.8.0)
    verbal_expressions (0.1.5)
    webrick (1.7.0)

 PLATFORMS
+  x86_64-darwin-20
  x86_64-linux

 DEPENDENCIES
@@ -303,4 +306,4 @@ DEPENDENCIES
  webrick (~> 1.7)

 BUNDLED WITH
-   2.2.27
+   2.2.29
@@ -88,6 +88,9 @@ collections:
  stories:
    output: true
    permalink: /:collection/:path/
+  playbooks:
+    output: true
+    permalink: /:collection/:path/

 defaults:
  # _docs
@@ -121,7 +124,17 @@ defaults:
      share: true
      related: true
      toc: true
-
+  # _playbooks
+  - scope:
+      path: "_playbooks"
+      type: playbooks
+    values:
+      layout: single
+      author_profile: false
+      comments: true
+      share: true
+      related: true
+      toc: true
 category_archive:
  type: liquid
  path: /categories/
@@ -135,4 +148,3 @@ analytics:
  google:
    tracking_id: "G-83V3JSYPS7"
    anonymize_ip: false # default
-
@@ -84,4 +84,11 @@ stories:
      - title: Malware
        url: /stories/malware/
      - title: Vulnerability
-        url: /stories/vulnerability/
+        url: /stories/vulnerability/
+playbooks:
+  - title: "Type"
+    children:
+      - title: "Response"
+        url: /tags/#response/
+      - title: "Investigation"
+        url: /tags/#investigation/
@@ -10,52 +10,52 @@ sidebar:

 | Name        | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
-| [Active Directory Discovery](/stories/active_directory_discovery/) | [Domain Account](/tags/#domain-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote System Discovery](/tags/#remote-system-discovery), [Domain Groups](/tags/#domain-groups), [Password Policy Discovery](/tags/#password-policy-discovery), [Local Groups](/tags/#local-groups), [System Owner/User Discovery](/tags/#system-owner/user-discovery), [Local Account](/tags/#local-account), [System Network Connections Discovery](/tags/#system-network-connections-discovery) | [Discovery](/tags/#discovery) |
+| [Active Directory Discovery](/stories/active_directory_discovery/) | [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) |
 | [Active Directory Password Spraying](/stories/active_directory_password_spraying/) | [Password Spraying](/tags/#password-spraying) | [Credential Access](/tags/#credential-access) |
-| [BITS Jobs](/stories/bits_jobs/) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Defense Evasion](/tags/#defense-evasion) |
+| [BITS Jobs](/stories/bits_jobs/) | [BITS Jobs](/tags/#bits-jobs) | [Defense Evasion](/tags/#defense-evasion) |
 | [Baron Samedit CVE-2021-3156](/stories/baron_samedit_cve-2021-3156/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) |
-| [Cobalt Strike](/stories/cobalt_strike/) | [Archive via Utility](/tags/#archive-via-utility), [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service), [Process Injection](/tags/#process-injection), [File Transfer Protocols](/tags/#file-transfer-protocols), [Regsvr32](/tags/#regsvr32), [Mshta](/tags/#mshta), [Service Execution](/tags/#service-execution), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Rundll32](/tags/#rundll32), [Scheduled Task](/tags/#scheduled-task), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Web Shell](/tags/#web-shell), [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Web Protocols](/tags/#web-protocols), [Remote System Discovery](/tags/#remote-system-discovery) | [Collection](/tags/#collection) |
-| [Collection and Staging](/stories/collection_and_staging/) | [Archive via Utility](/tags/#archive-via-utility), [Local Email Collection](/tags/#local-email-collection), [Remote Email Collection](/tags/#remote-email-collection), [Masquerading](/tags/#masquerading) | [Collection](/tags/#collection) |
-| [Command and Control](/stories/command_and_control/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) |
-| [Credential Dumping](/stories/credential_dumping/) | [LSASS Memory](/tags/#lsass-memory), [Process Injection](/tags/#process-injection), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Access Token Manipulation](/tags/#access-token-manipulation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Modify Authentication Process](/tags/#modify-authentication-process), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Account Discovery](/tags/#account-discovery), [Password Policy Discovery](/tags/#password-policy-discovery), [Unsecured Credentials](/tags/#unsecured-credentials), [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager), [NTDS](/tags/#ntds), [Kerberoasting](/tags/#kerberoasting), [PowerShell](/tags/#powershell) | [Credential Access](/tags/#credential-access) |
+| [Cobalt Strike](/stories/cobalt_strike/) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
+| [Collection and Staging](/stories/collection_and_staging/) | [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) |
+| [Command and Control](/stories/command_and_control/) | [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) |
+| [Credential Dumping](/stories/credential_dumping/) | [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) |
 | [DNS Hijacking](/stories/dns_hijacking/) | [Drive-by Compromise](/tags/#drive-by-compromise) | [Initial Access](/tags/#initial-access) |
-| [Data Exfiltration](/stories/data_exfiltration/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) |
+| [Data Exfiltration](/stories/data_exfiltration/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | [Exfiltration](/tags/#exfiltration) |
 | [Deobfuscate-Decode Files or Information](/stories/deobfuscate-decode_files_or_information/) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information) | [Defense Evasion](/tags/#defense-evasion) |
-| [Detect Zerologon Attack](/stories/detect_zerologon_attack/) | [Exploitation of Remote Services](/tags/#exploitation-of-remote-services), [LSASS Memory](/tags/#lsass-memory), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Lateral Movement](/tags/#lateral-movement) |
-| [Disabling Security Tools](/stories/disabling_security_tools/) | [Install Root Certificate](/tags/#install-root-certificate), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Windows Service](/tags/#windows-service), [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion) |
-| [Domain Trust Discovery](/stories/domain_trust_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) |
+| [Detect Zerologon Attack](/stories/detect_zerologon_attack/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
+| [Disabling Security Tools](/stories/disabling_security_tools/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) |
+| [Domain Trust Discovery](/stories/domain_trust_discovery/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) |
 | [F5 TMUI RCE CVE-2020-5902](/stories/f5_tmui_rce_cve-2020-5902/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
-| [HAFNIUM Group](/stories/hafnium_group/) | [PowerShell](/tags/#powershell), [Web Shell](/tags/#web-shell), [Local Account](/tags/#local-account), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [LSASS Memory](/tags/#lsass-memory), [Remote Email Collection](/tags/#remote-email-collection), [NTDS](/tags/#ntds), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Execution](/tags/#execution) |
-| [Ingress Tool Transfer](/stories/ingress_tool_transfer/) | [PowerShell](/tags/#powershell), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [OS Credential Dumping](/tags/#os-credential-dumping), [Remote Services](/tags/#remote-services), [Screen Capture](/tags/#screen-capture), [Audio Capture](/tags/#audio-capture), [Remote Service Session Hijacking](/tags/#remote-service-session-hijacking), [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Impair Defenses](/tags/#impair-defenses) | [Execution](/tags/#execution) |
-| [Lateral Movement](/stories/lateral_movement/) | [Pass the Hash](/tags/#pass-the-hash), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [Kerberoasting](/tags/#kerberoasting), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Scheduled Task](/tags/#scheduled-task) | [Defense Evasion](/tags/#defense-evasion) |
-| [Malicious PowerShell](/stories/malicious_powershell/) | [PowerShell](/tags/#powershell), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [OS Credential Dumping](/tags/#os-credential-dumping), [Remote Services](/tags/#remote-services), [Screen Capture](/tags/#screen-capture), [Audio Capture](/tags/#audio-capture), [Remote Service Session Hijacking](/tags/#remote-service-session-hijacking), [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Impair Defenses](/tags/#impair-defenses) | [Execution](/tags/#execution) |
-| [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities/) | [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [Rundll32](/tags/#rundll32), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) |
+| [HAFNIUM Group](/stories/hafnium_group/) | [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) |
+| [Ingress Tool Transfer](/stories/ingress_tool_transfer/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control) |
+| [Lateral Movement](/stories/lateral_movement/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
+| [Malicious PowerShell](/stories/malicious_powershell/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | [Reconnaissance](/tags/#reconnaissance) |
+| [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities/) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
 | [Meterpreter](/stories/meterpreter/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) |
-| [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444/) | [Control Panel](/tags/#control-panel), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
-| [NOBELIUM Group](/stories/nobelium_group/) | [Archive via Utility](/tags/#archive-via-utility), [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service), [Process Injection](/tags/#process-injection), [File Transfer Protocols](/tags/#file-transfer-protocols), [Regsvr32](/tags/#regsvr32), [Mshta](/tags/#mshta), [Service Execution](/tags/#service-execution), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Rundll32](/tags/#rundll32), [Scheduled Task](/tags/#scheduled-task), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Web Shell](/tags/#web-shell), [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Web Protocols](/tags/#web-protocols), [Remote System Discovery](/tags/#remote-system-discovery) | [Collection](/tags/#collection) |
-| [PetitPotam NTLM Relay on Active Directory Certificate Services](/stories/petitpotam_ntlm_relay_on_active_directory_certificate_services/) | [Forced Authentication](/tags/#forced-authentication), [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) |
-| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns/) | [PowerShell](/tags/#powershell), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | [Execution](/tags/#execution) |
-| [ProxyShell](/stories/proxyshell/) | [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [PowerShell](/tags/#powershell) | [Persistence](/tags/#persistence) |
+| [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
+| [NOBELIUM Group](/stories/nobelium_group/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) |
+| [PetitPotam NTLM Relay on Active Directory Certificate Services](/stories/petitpotam_ntlm_relay_on_active_directory_certificate_services/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) |
+| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | [Persistence](/tags/#persistence) |
+| [ProxyShell](/stories/proxyshell/) | [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) |
 | [SQL Injection](/stories/sql_injection/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
-| [Silver Sparrow](/stories/silver_sparrow/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Launch Agent](/tags/#launch-agent), [Data Staged](/tags/#data-staged) | [Command And Control](/tags/#command-and-control) |
-| [Spearphishing Attachments](/stories/spearphishing_attachments/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Security Account Manager](/tags/#security-account-manager), [Spearphishing Link](/tags/#spearphishing-link) | [Initial Access](/tags/#initial-access) |
-| [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions/) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Rename System Utilities](/tags/#rename-system-utilities) | [Execution](/tags/#execution) |
+| [Silver Sparrow](/stories/silver_sparrow/) | [Data Staged](/tags/#data-staged) | [Collection](/tags/#collection) |
+| [Spearphishing Attachments](/stories/spearphishing_attachments/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) |
+| [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions/) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious Compiled HTML Activity](/stories/suspicious_compiled_html_activity/) | [Compiled HTML File](/tags/#compiled-html-file) | [Defense Evasion](/tags/#defense-evasion) |
-| [Suspicious DNS Traffic](/stories/suspicious_dns_traffic/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) |
+| [Suspicious DNS Traffic](/stories/suspicious_dns_traffic/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) |
 | [Suspicious Emails](/stories/suspicious_emails/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) |
-| [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity/) | [Mshta](/tags/#mshta), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | [Defense Evasion](/tags/#defense-evasion) |
+| [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity/) | [Mshta](/tags/#mshta) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious Okta Activity](/stories/suspicious_okta_activity/) | [Default Accounts](/tags/#default-accounts) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious Regsvcs Regasm Activity](/stories/suspicious_regsvcs_regasm_activity/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious Regsvr32 Activity](/stories/suspicious_regsvr32_activity/) | [Regsvr32](/tags/#regsvr32) | [Defense Evasion](/tags/#defense-evasion) |
-| [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity/) | [Rundll32](/tags/#rundll32), [LSASS Memory](/tags/#lsass-memory), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
-| [Suspicious WMI Use](/stories/suspicious_wmi_use/) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription), [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [Privilege Escalation](/tags/#privilege-escalation) |
-| [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Masquerading](/tags/#masquerading), [Port Monitors](/tags/#port-monitors), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Application Shimming](/tags/#application-shimming), [Screen Capture](/tags/#screen-capture), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Privilege Escalation](/tags/#privilege-escalation) |
-| [Suspicious Zoom Child Processes](/stories/suspicious_zoom_child_processes/) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Rename System Utilities](/tags/#rename-system-utilities) | [Execution](/tags/#execution) |
-| [Trusted Developer Utilities Proxy Execution](/stories/trusted_developer_utilities_proxy_execution/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
+| [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
+| [Suspicious WMI Use](/stories/suspicious_wmi_use/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [Execution](/tags/#execution) |
+| [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities/) | [Application Shimming](/tags/#application-shimming) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Suspicious Zoom Child Processes](/stories/suspicious_zoom_child_processes/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Trusted Developer Utilities Proxy Execution](/stories/trusted_developer_utilities_proxy_execution/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | [Defense Evasion](/tags/#defense-evasion) |
 | [Trusted Developer Utilities Proxy Execution MSBuild](/stories/trusted_developer_utilities_proxy_execution_msbuild/) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
 | [Windows DNS SIGRed CVE-2020-1350](/stories/windows_dns_sigred_cve-2020-1350/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) |
-| [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Bypass User Account Control](/tags/#bypass-user-account-control), [Modify Registry](/tags/#modify-registry), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows Discovery Techniques](/stories/windows_discovery_techniques/) | [Valid Accounts](/tags/#valid-accounts), [Account Discovery](/tags/#account-discovery), [Domain Policy Modification](/tags/#domain-policy-modification), [Trusted Relationship](/tags/#trusted-relationship), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Gather Victim Org Information](/tags/#gather-victim-org-information), [Active Scanning](/tags/#active-scanning), [Gather Victim Host Information](/tags/#gather-victim-host-information), [System Service Discovery](/tags/#system-service-discovery), [Query Registry](/tags/#query-registry), [Network Service Scanning](/tags/#network-service-scanning), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Discovery](/tags/#process-discovery), [File and Directory Discovery](/tags/#file-and-directory-discovery), [Software Discovery](/tags/#software-discovery), [Software](/tags/#software), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Network Share Discovery](/tags/#network-share-discovery), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Credentials](/tags/#credentials), [Domain Properties](/tags/#domain-properties), [Network Trust Dependencies](/tags/#network-trust-dependencies), [Account Manipulation](/tags/#account-manipulation), [Vulnerability Scanning](/tags/#vulnerability-scanning), [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows Log Manipulation](/stories/windows_log_manipulation/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Impact](/tags/#impact) |
-| [Windows Persistence Techniques](/stories/windows_persistence_techniques/) | [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Establish Accounts](/tags/#establish-accounts), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Rogue Domain Controller](/tags/#rogue-domain-controller), [Domain Policy Modification](/tags/#domain-policy-modification), [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Port Monitors](/tags/#port-monitors), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Application Shimming](/tags/#application-shimming), [Windows Service](/tags/#windows-service), [Scheduled Task](/tags/#scheduled-task), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Persistence](/tags/#persistence) |
-| [Windows Privilege Escalation](/stories/windows_privilege_escalation/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Accessibility Features](/tags/#accessibility-features), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) |
+| [Windows Discovery Techniques](/stories/windows_discovery_techniques/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Process Injection](/tags/#process-injection), [Hijack Execution Flow](/tags/#hijack-execution-flow) | [Persistence](/tags/#persistence) |
+| [Windows Log Manipulation](/stories/windows_log_manipulation/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
+| [Windows Persistence Techniques](/stories/windows_persistence_techniques/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
+| [Windows Privilege Escalation](/stories/windows_privilege_escalation/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) |
@@ -12,6 +12,6 @@ sidebar:
 | ----------- | ----------- |--------------|
 | [Asset Tracking]() | None | None |
 | [Monitor for Updates]() | None | None |
-| [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Drive-by Compromise](/tags/#drive-by-compromise), [Remote Services](/tags/#remote-services), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Web Protocols](/tags/#web-protocols) | [Lateral Movement](/tags/#lateral-movement) |
-| [Router and Infrastructure Security](/stories/router_and_infrastructure_security/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [ARP Cache Poisoning](/tags/#arp-cache-poisoning), [Man-in-the-Middle](/tags/#man-in-the-middle), [TFTP Boot](/tags/#tftp-boot), [Traffic Duplication](/tags/#traffic-duplication) | [Initial Access](/tags/#initial-access) |
+| [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch/) | [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) |
+| [Router and Infrastructure Security](/stories/router_and_infrastructure_security/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Traffic Duplication](/tags/#traffic-duplication) | [Initial Access](/tags/#initial-access) |
 | [Use of Cleartext Protocols]() | None | None |
@@ -10,24 +10,24 @@ sidebar:

 | Name        | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
-| [AWS Cross Account Activity](/stories/aws_cross_account_activity/) | [Valid Accounts](/tags/#valid-accounts), [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material) | [Defense Evasion](/tags/#defense-evasion) |
-| [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation/) | [Cloud Accounts](/tags/#cloud-accounts), [Cloud Account](/tags/#cloud-account), [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [Brute Force](/tags/#brute-force), [Account Manipulation](/tags/#account-manipulation), [Cloud Groups](/tags/#cloud-groups) | [Defense Evasion](/tags/#defense-evasion) |
+| [AWS Cross Account Activity](/stories/aws_cross_account_activity/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material) | [Defense Evasion](/tags/#defense-evasion) |
+| [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation/) | [Cloud Account](/tags/#cloud-account) | [Persistence](/tags/#persistence) |
 | [AWS Network ACL Activity](/stories/aws_network_acl_activity/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | [Defense Evasion](/tags/#defense-evasion) |
 | [AWS Security Hub Alerts]() | None | None |
 | [AWS User Monitoring](/stories/aws_user_monitoring/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
-| [Cloud Cryptomining](/stories/cloud_cryptomining/) | [Cloud Accounts](/tags/#cloud-accounts), [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) |
-| [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse/) | [Valid Accounts](/tags/#valid-accounts), [LSASS Memory](/tags/#lsass-memory), [Cloud Account](/tags/#cloud-account), [Modify Authentication Process](/tags/#modify-authentication-process), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Defense Evasion](/tags/#defense-evasion) |
+| [Cloud Cryptomining](/stories/cloud_cryptomining/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) |
+| [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) |
 | [Container Implantation Monitoring and Investigation](/stories/container_implantation_monitoring_and_investigation/) | [Implant Internal Image](/tags/#implant-internal-image) | [Persistence](/tags/#persistence) |
-| [Dev Sec Ops](/stories/dev_sec_ops/) | [Malicious Image](/tags/#malicious-image), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Exploitation for Credential Access](/tags/#exploitation-for-credential-access), [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Execution](/tags/#execution) |
+| [Dev Sec Ops](/stories/dev_sec_ops/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
 | [GCP Cross Account Activity](/stories/gcp_cross_account_activity/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) |
 | [Kubernetes Scanning Activity](/stories/kubernetes_scanning_activity/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
 | [Kubernetes Sensitive Object Access Activity]() | None | None |
-| [Office 365 Detections](/stories/office_365_detections/) | [Password Guessing](/tags/#password-guessing), [Cloud Account](/tags/#cloud-account), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Modify Authentication Process](/tags/#modify-authentication-process), [Brute Force](/tags/#brute-force), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Remote Email Collection](/tags/#remote-email-collection) | [Credential Access](/tags/#credential-access) |
+| [Office 365 Detections](/stories/office_365_detections/) | [Email Forwarding Rule](/tags/#email-forwarding-rule) | [Collection](/tags/#collection) |
 | [Suspicious AWS Login Activities](/stories/suspicious_aws_login_activities/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious AWS S3 Activities](/stories/suspicious_aws_s3_activities/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) |
 | [Suspicious AWS Traffic]() | None | None |
 | [Suspicious Cloud Authentication Activities](/stories/suspicious_cloud_authentication_activities/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) |
-| [Suspicious Cloud Instance Activities](/stories/suspicious_cloud_instance_activities/) | [Cloud Accounts](/tags/#cloud-accounts), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Defense Evasion](/tags/#defense-evasion) |
+| [Suspicious Cloud Instance Activities](/stories/suspicious_cloud_instance_activities/) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Exfiltration](/tags/#exfiltration) |
 | [Suspicious Cloud Provisioning Activities](/stories/suspicious_cloud_provisioning_activities/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) |
-| [Suspicious Cloud User Activities](/stories/suspicious_cloud_user_activities/) | [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | [Discovery](/tags/#discovery) |
+| [Suspicious Cloud User Activities](/stories/suspicious_cloud_user_activities/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious GCP Storage Activities](/stories/suspicious_gcp_storage_activities/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) |
@@ -10,4 +10,4 @@ sidebar:

 | Name        | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
-| [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527/) | [Print Processors](/tags/#print-processors), [Rundll32](/tags/#rundll32), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Persistence](/tags/#persistence) |
+| [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
@@ -10,25 +10,25 @@ sidebar:

 | Name        | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
-| [BlackMatter Ransomware](/stories/blackmatter_ransomware/) | [Credentials in Registry](/tags/#credentials-in-registry), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Defacement](/tags/#defacement), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Credential Access](/tags/#credential-access) |
-| [Clop Ransomware](/stories/clop_ransomware/) | [User Execution](/tags/#user-execution), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Data Destruction](/tags/#data-destruction), [Service Execution](/tags/#service-execution), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Service Stop](/tags/#service-stop), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Execution](/tags/#execution) |
+| [BlackMatter Ransomware](/stories/blackmatter_ransomware/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |
+| [Clop Ransomware](/stories/clop_ransomware/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
 | [ColdRoot MacOS RAT]() | None | None |
-| [DHS Report TA18-074A](/stories/dhs_report_ta18-074a/) | [Local Account](/tags/#local-account), [File Transfer Protocols](/tags/#file-transfer-protocols), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [PowerShell](/tags/#powershell), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Windows Service](/tags/#windows-service), [Scheduled Task](/tags/#scheduled-task), [Malicious File](/tags/#malicious-file), [Modify Registry](/tags/#modify-registry) | [Persistence](/tags/#persistence) |
-| [DarkSide Ransomware](/stories/darkside_ransomware/) | [Security Account Manager](/tags/#security-account-manager), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [CMSTP](/tags/#cmstp), [Process Injection](/tags/#process-injection), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [LSASS Memory](/tags/#lsass-memory), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Automated Exfiltration](/tags/#automated-exfiltration), [Service Execution](/tags/#service-execution), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Bypass User Account Control](/tags/#bypass-user-account-control) | [Credential Access](/tags/#credential-access) |
-| [Dynamic DNS](/stories/dynamic_dns/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) |
-| [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_/) | [Windows Command Shell](/tags/#windows-command-shell), [Software Deployment Tools](/tags/#software-deployment-tools), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Execution](/tags/#execution) |
-| [FIN7](/stories/fin7/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery), [JavaScript](/tags/#javascript), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Spearphishing Attachment](/tags/#spearphishing-attachment), [XSL Script Processing](/tags/#xsl-script-processing) | [Discovery](/tags/#discovery) |
-| [Hidden Cobra Malware](/stories/hidden_cobra_malware/) | [Network Share Connection Removal](/tags/#network-share-connection-removal), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [File Transfer Protocols](/tags/#file-transfer-protocols), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Defense Evasion](/tags/#defense-evasion) |
-| [IcedID](/stories/icedid/) | [Domain Account](/tags/#domain-account), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [Malicious File](/tags/#malicious-file), [Bypass User Account Control](/tags/#bypass-user-account-control), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Regsvr32](/tags/#regsvr32), [IP Addresses](/tags/#ip-addresses), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Scheduled Task](/tags/#scheduled-task), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Discovery](/tags/#discovery) |
-| [Orangeworm Attack Group](/stories/orangeworm_attack_group/) | [Service Execution](/tags/#service-execution), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Windows Service](/tags/#windows-service) | [Execution](/tags/#execution) |
-| [Ransomware](/stories/ransomware/) | [Archive via Utility](/tags/#archive-via-utility), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Service Stop](/tags/#service-stop), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [CMSTP](/tags/#cmstp), [File Deletion](/tags/#file-deletion), [Data Destruction](/tags/#data-destruction), [User Execution](/tags/#user-execution), [Automated Exfiltration](/tags/#automated-exfiltration), [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Account Access Removal](/tags/#account-access-removal), [Service Execution](/tags/#service-execution), [Visual Basic](/tags/#visual-basic), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Modify Registry](/tags/#modify-registry), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Scheduled Task](/tags/#scheduled-task), [Rename System Utilities](/tags/#rename-system-utilities), [Web Protocols](/tags/#web-protocols), [Msiexec](/tags/#msiexec) | [Collection](/tags/#collection) |
+| [DHS Report TA18-074A](/stories/dhs_report_ta18-074a/) | [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion) |
+| [DarkSide Ransomware](/stories/darkside_ransomware/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Dynamic DNS](/stories/dynamic_dns/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) |
+| [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) |
+| [FIN7](/stories/fin7/) | [XSL Script Processing](/tags/#xsl-script-processing) | [Defense Evasion](/tags/#defense-evasion) |
+| [Hidden Cobra Malware](/stories/hidden_cobra_malware/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) |
+| [IcedID](/stories/icedid/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
+| [Orangeworm Attack Group](/stories/orangeworm_attack_group/) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) |
+| [Ransomware](/stories/ransomware/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
 | [Ransomware Cloud](/stories/ransomware_cloud/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |
-| [Remcos](/stories/remcos/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Masquerading](/tags/#masquerading), [Port Monitors](/tags/#port-monitors), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Application Shimming](/tags/#application-shimming), [Screen Capture](/tags/#screen-capture), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Privilege Escalation](/tags/#privilege-escalation) |
-| [Revil Ransomware](/stories/revil_ransomware/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [User Execution](/tags/#user-execution), [Modify Registry](/tags/#modify-registry), [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion) |
-| [Ryuk Ransomware](/stories/ryuk_ransomware/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Data Destruction](/tags/#data-destruction), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Command Shell](/tags/#windows-command-shell), [Scheduled Task](/tags/#scheduled-task), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) |
-| [SamSam Ransomware](/stories/samsam_ransomware/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping), [Service Stop](/tags/#service-stop), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Account Access Removal](/tags/#account-access-removal), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Software Deployment Tools](/tags/#software-deployment-tools), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Rundll32](/tags/#rundll32), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Defense Evasion](/tags/#defense-evasion) |
-| [Trickbot](/stories/trickbot/) | [Domain Account](/tags/#domain-account), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [Malicious File](/tags/#malicious-file), [Bypass User Account Control](/tags/#bypass-user-account-control), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Regsvr32](/tags/#regsvr32), [IP Addresses](/tags/#ip-addresses), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Scheduled Task](/tags/#scheduled-task), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Discovery](/tags/#discovery) |
-| [Unusual Processes](/stories/unusual_processes/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping), [Service Stop](/tags/#service-stop), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Account Access Removal](/tags/#account-access-removal), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Software Deployment Tools](/tags/#software-deployment-tools), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Rundll32](/tags/#rundll32), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows File Extension and Association Abuse](/stories/windows_file_extension_and_association_abuse/) | [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [Rundll32](/tags/#rundll32), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows Service Abuse](/stories/windows_service_abuse/) | [Service Execution](/tags/#service-execution), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Windows Service](/tags/#windows-service) | [Execution](/tags/#execution) |
-| [XMRig](/stories/xmrig/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping), [Service Stop](/tags/#service-stop), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Account Access Removal](/tags/#account-access-removal), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Software Deployment Tools](/tags/#software-deployment-tools), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Rundll32](/tags/#rundll32), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Defense Evasion](/tags/#defense-evasion) |
+| [Remcos](/stories/remcos/) | [Screen Capture](/tags/#screen-capture) | [Collection](/tags/#collection) |
+| [Revil Ransomware](/stories/revil_ransomware/) | [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion) |
+| [Ryuk Ransomware](/stories/ryuk_ransomware/) | [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) |
+| [SamSam Ransomware](/stories/samsam_ransomware/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |
+| [Trickbot](/stories/trickbot/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) |
+| [Unusual Processes](/stories/unusual_processes/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
+| [Windows File Extension and Association Abuse](/stories/windows_file_extension_and_association_abuse/) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
+| [Windows Service Abuse](/stories/windows_service_abuse/) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) |
+| [XMRig](/stories/xmrig/) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) |
@@ -1,8 +1,13 @@
 ---
 title: "Playbooks"
-layout: single
+layout: collection
 author_profile: false
 permalink: /playbooks/
+classes: wide
+sidebar:
+  nav: "playbooks"
 ---

-### Come back soon, work in progress 👷‍♀️ 🏗 ..
+| Name    | Detections | Type        |
+| --------| ---------- | ----------- |
+| [Ransomware Investigate and Contain](/playbooks/ransomware_investigate_and_contain/)|[Conti Common Exec parameter](/detections/TTP/conti_common_exec_parameter)| Response |
@@ -10,107 +10,107 @@ sidebar:

 | Name    |   Technique |     Tactic   |
 | ----------- | ----------- |--------------|
-| [AWS Cross Account Activity](aws_cross_account_activity) | [Valid Accounts](/tags/#valid-accounts), [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material) | [Defense Evasion](/tags/#defense-evasion) |
-| [AWS IAM Privilege Escalation](aws_iam_privilege_escalation) | [Cloud Accounts](/tags/#cloud-accounts), [Cloud Account](/tags/#cloud-account), [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [Brute Force](/tags/#brute-force), [Account Manipulation](/tags/#account-manipulation), [Cloud Groups](/tags/#cloud-groups) | [Defense Evasion](/tags/#defense-evasion) |
+| [AWS Cross Account Activity](aws_cross_account_activity) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material) | [Defense Evasion](/tags/#defense-evasion) |
+| [AWS IAM Privilege Escalation](aws_iam_privilege_escalation) | [Cloud Account](/tags/#cloud-account) | [Persistence](/tags/#persistence) |
 | [AWS Network ACL Activity](aws_network_acl_activity) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | [Defense Evasion](/tags/#defense-evasion) |
 | [AWS Security Hub Alerts]() | None | None |
 | [AWS User Monitoring](aws_user_monitoring) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
-| [Active Directory Discovery](active_directory_discovery) | [Domain Account](/tags/#domain-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote System Discovery](/tags/#remote-system-discovery), [Domain Groups](/tags/#domain-groups), [Password Policy Discovery](/tags/#password-policy-discovery), [Local Groups](/tags/#local-groups), [System Owner/User Discovery](/tags/#system-owner/user-discovery), [Local Account](/tags/#local-account), [System Network Connections Discovery](/tags/#system-network-connections-discovery) | [Discovery](/tags/#discovery) |
+| [Active Directory Discovery](active_directory_discovery) | [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) |
 | [Active Directory Password Spraying](active_directory_password_spraying) | [Password Spraying](/tags/#password-spraying) | [Credential Access](/tags/#credential-access) |
 | [Apache Struts Vulnerability](apache_struts_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) |
 | [Asset Tracking]() | None | None |
-| [BITS Jobs](bits_jobs) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Defense Evasion](/tags/#defense-evasion) |
+| [BITS Jobs](bits_jobs) | [BITS Jobs](/tags/#bits-jobs) | [Defense Evasion](/tags/#defense-evasion) |
 | [Baron Samedit CVE-2021-3156](baron_samedit_cve-2021-3156) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) |
-| [BlackMatter Ransomware](blackmatter_ransomware) | [Credentials in Registry](/tags/#credentials-in-registry), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Defacement](/tags/#defacement), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Credential Access](/tags/#credential-access) |
+| [BlackMatter Ransomware](blackmatter_ransomware) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |
 | [Brand Monitoring]() | None | None |
-| [Clop Ransomware](clop_ransomware) | [User Execution](/tags/#user-execution), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Data Destruction](/tags/#data-destruction), [Service Execution](/tags/#service-execution), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Service Stop](/tags/#service-stop), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Execution](/tags/#execution) |
-| [Cloud Cryptomining](cloud_cryptomining) | [Cloud Accounts](/tags/#cloud-accounts), [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) |
-| [Cloud Federated Credential Abuse](cloud_federated_credential_abuse) | [Valid Accounts](/tags/#valid-accounts), [LSASS Memory](/tags/#lsass-memory), [Cloud Account](/tags/#cloud-account), [Modify Authentication Process](/tags/#modify-authentication-process), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Defense Evasion](/tags/#defense-evasion) |
-| [Cobalt Strike](cobalt_strike) | [Archive via Utility](/tags/#archive-via-utility), [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service), [Process Injection](/tags/#process-injection), [File Transfer Protocols](/tags/#file-transfer-protocols), [Regsvr32](/tags/#regsvr32), [Mshta](/tags/#mshta), [Service Execution](/tags/#service-execution), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Rundll32](/tags/#rundll32), [Scheduled Task](/tags/#scheduled-task), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Web Shell](/tags/#web-shell), [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Web Protocols](/tags/#web-protocols), [Remote System Discovery](/tags/#remote-system-discovery) | [Collection](/tags/#collection) |
+| [Clop Ransomware](clop_ransomware) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
+| [Cloud Cryptomining](cloud_cryptomining) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) |
+| [Cloud Federated Credential Abuse](cloud_federated_credential_abuse) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Cobalt Strike](cobalt_strike) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
 | [ColdRoot MacOS RAT]() | None | None |
-| [Collection and Staging](collection_and_staging) | [Archive via Utility](/tags/#archive-via-utility), [Local Email Collection](/tags/#local-email-collection), [Remote Email Collection](/tags/#remote-email-collection), [Masquerading](/tags/#masquerading) | [Collection](/tags/#collection) |
-| [Command and Control](command_and_control) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) |
+| [Collection and Staging](collection_and_staging) | [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) |
+| [Command and Control](command_and_control) | [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) |
 | [Container Implantation Monitoring and Investigation](container_implantation_monitoring_and_investigation) | [Implant Internal Image](/tags/#implant-internal-image) | [Persistence](/tags/#persistence) |
-| [Credential Dumping](credential_dumping) | [LSASS Memory](/tags/#lsass-memory), [Process Injection](/tags/#process-injection), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Access Token Manipulation](/tags/#access-token-manipulation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Modify Authentication Process](/tags/#modify-authentication-process), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Account Discovery](/tags/#account-discovery), [Password Policy Discovery](/tags/#password-policy-discovery), [Unsecured Credentials](/tags/#unsecured-credentials), [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager), [NTDS](/tags/#ntds), [Kerberoasting](/tags/#kerberoasting), [PowerShell](/tags/#powershell) | [Credential Access](/tags/#credential-access) |
-| [DHS Report TA18-074A](dhs_report_ta18-074a) | [Local Account](/tags/#local-account), [File Transfer Protocols](/tags/#file-transfer-protocols), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [PowerShell](/tags/#powershell), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Windows Service](/tags/#windows-service), [Scheduled Task](/tags/#scheduled-task), [Malicious File](/tags/#malicious-file), [Modify Registry](/tags/#modify-registry) | [Persistence](/tags/#persistence) |
+| [Credential Dumping](credential_dumping) | [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) |
+| [DHS Report TA18-074A](dhs_report_ta18-074a) | [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion) |
 | [DNS Amplification Attacks](dns_amplification_attacks) | [Reflection Amplification](/tags/#reflection-amplification) | [Impact](/tags/#impact) |
 | [DNS Hijacking](dns_hijacking) | [Drive-by Compromise](/tags/#drive-by-compromise) | [Initial Access](/tags/#initial-access) |
-| [DarkSide Ransomware](darkside_ransomware) | [Security Account Manager](/tags/#security-account-manager), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [CMSTP](/tags/#cmstp), [Process Injection](/tags/#process-injection), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [LSASS Memory](/tags/#lsass-memory), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Automated Exfiltration](/tags/#automated-exfiltration), [Service Execution](/tags/#service-execution), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Bypass User Account Control](/tags/#bypass-user-account-control) | [Credential Access](/tags/#credential-access) |
-| [Data Exfiltration](data_exfiltration) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) |
+| [DarkSide Ransomware](darkside_ransomware) | [Bypass User Account Control](/tags/#bypass-user-account-control) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Data Exfiltration](data_exfiltration) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | [Exfiltration](/tags/#exfiltration) |
 | [Data Protection](data_protection) | [Drive-by Compromise](/tags/#drive-by-compromise) | [Initial Access](/tags/#initial-access) |
 | [Deobfuscate-Decode Files or Information](deobfuscate-decode_files_or_information) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information) | [Defense Evasion](/tags/#defense-evasion) |
-| [Detect Zerologon Attack](detect_zerologon_attack) | [Exploitation of Remote Services](/tags/#exploitation-of-remote-services), [LSASS Memory](/tags/#lsass-memory), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Lateral Movement](/tags/#lateral-movement) |
-| [Dev Sec Ops](dev_sec_ops) | [Malicious Image](/tags/#malicious-image), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Exploitation for Credential Access](/tags/#exploitation-for-credential-access), [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Execution](/tags/#execution) |
-| [Disabling Security Tools](disabling_security_tools) | [Install Root Certificate](/tags/#install-root-certificate), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Windows Service](/tags/#windows-service), [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion) |
-| [Domain Trust Discovery](domain_trust_discovery) | [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) |
-| [Dynamic DNS](dynamic_dns) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) |
-| [Emotet Malware  DHS Report TA18-201A ](emotet_malware__dhs_report_ta18-201a_) | [Windows Command Shell](/tags/#windows-command-shell), [Software Deployment Tools](/tags/#software-deployment-tools), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Execution](/tags/#execution) |
+| [Detect Zerologon Attack](detect_zerologon_attack) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
+| [Dev Sec Ops](dev_sec_ops) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
+| [Disabling Security Tools](disabling_security_tools) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) |
+| [Domain Trust Discovery](domain_trust_discovery) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) |
+| [Dynamic DNS](dynamic_dns) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) |
+| [Emotet Malware  DHS Report TA18-201A ](emotet_malware__dhs_report_ta18-201a_) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) |
 | [F5 TMUI RCE CVE-2020-5902](f5_tmui_rce_cve-2020-5902) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
-| [FIN7](fin7) | [System Owner/User Discovery](/tags/#system-owner/user-discovery), [JavaScript](/tags/#javascript), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Spearphishing Attachment](/tags/#spearphishing-attachment), [XSL Script Processing](/tags/#xsl-script-processing) | [Discovery](/tags/#discovery) |
+| [FIN7](fin7) | [XSL Script Processing](/tags/#xsl-script-processing) | [Defense Evasion](/tags/#defense-evasion) |
 | [GCP Cross Account Activity](gcp_cross_account_activity) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) |
-| [HAFNIUM Group](hafnium_group) | [PowerShell](/tags/#powershell), [Web Shell](/tags/#web-shell), [Local Account](/tags/#local-account), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [LSASS Memory](/tags/#lsass-memory), [Remote Email Collection](/tags/#remote-email-collection), [NTDS](/tags/#ntds), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Execution](/tags/#execution) |
-| [Hidden Cobra Malware](hidden_cobra_malware) | [Network Share Connection Removal](/tags/#network-share-connection-removal), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [File Transfer Protocols](/tags/#file-transfer-protocols), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Defense Evasion](/tags/#defense-evasion) |
-| [IcedID](icedid) | [Domain Account](/tags/#domain-account), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [Malicious File](/tags/#malicious-file), [Bypass User Account Control](/tags/#bypass-user-account-control), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Regsvr32](/tags/#regsvr32), [IP Addresses](/tags/#ip-addresses), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Scheduled Task](/tags/#scheduled-task), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Discovery](/tags/#discovery) |
-| [Ingress Tool Transfer](ingress_tool_transfer) | [PowerShell](/tags/#powershell), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [OS Credential Dumping](/tags/#os-credential-dumping), [Remote Services](/tags/#remote-services), [Screen Capture](/tags/#screen-capture), [Audio Capture](/tags/#audio-capture), [Remote Service Session Hijacking](/tags/#remote-service-session-hijacking), [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Impair Defenses](/tags/#impair-defenses) | [Execution](/tags/#execution) |
+| [HAFNIUM Group](hafnium_group) | [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) |
+| [Hidden Cobra Malware](hidden_cobra_malware) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) |
+| [IcedID](icedid) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
+| [Ingress Tool Transfer](ingress_tool_transfer) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control) |
 | [JBoss Vulnerability](jboss_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) |
 | [Kubernetes Scanning Activity](kubernetes_scanning_activity) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
 | [Kubernetes Sensitive Object Access Activity]() | None | None |
-| [Lateral Movement](lateral_movement) | [Pass the Hash](/tags/#pass-the-hash), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [Kerberoasting](/tags/#kerberoasting), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Scheduled Task](/tags/#scheduled-task) | [Defense Evasion](/tags/#defense-evasion) |
-| [Malicious PowerShell](malicious_powershell) | [PowerShell](/tags/#powershell), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [OS Credential Dumping](/tags/#os-credential-dumping), [Remote Services](/tags/#remote-services), [Screen Capture](/tags/#screen-capture), [Audio Capture](/tags/#audio-capture), [Remote Service Session Hijacking](/tags/#remote-service-session-hijacking), [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Impair Defenses](/tags/#impair-defenses) | [Execution](/tags/#execution) |
-| [Masquerading - Rename System Utilities](masquerading_-_rename_system_utilities) | [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [Rundll32](/tags/#rundll32), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) |
+| [Lateral Movement](lateral_movement) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
+| [Malicious PowerShell](malicious_powershell) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | [Reconnaissance](/tags/#reconnaissance) |
+| [Masquerading - Rename System Utilities](masquerading_-_rename_system_utilities) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
 | [Meterpreter](meterpreter) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) |
-| [Microsoft MSHTML Remote Code Execution CVE-2021-40444](microsoft_mshtml_remote_code_execution_cve-2021-40444) | [Control Panel](/tags/#control-panel), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
+| [Microsoft MSHTML Remote Code Execution CVE-2021-40444](microsoft_mshtml_remote_code_execution_cve-2021-40444) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
 | [Monitor for Updates]() | None | None |
-| [NOBELIUM Group](nobelium_group) | [Archive via Utility](/tags/#archive-via-utility), [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service), [Process Injection](/tags/#process-injection), [File Transfer Protocols](/tags/#file-transfer-protocols), [Regsvr32](/tags/#regsvr32), [Mshta](/tags/#mshta), [Service Execution](/tags/#service-execution), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Rundll32](/tags/#rundll32), [Scheduled Task](/tags/#scheduled-task), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Web Shell](/tags/#web-shell), [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Web Protocols](/tags/#web-protocols), [Remote System Discovery](/tags/#remote-system-discovery) | [Collection](/tags/#collection) |
+| [NOBELIUM Group](nobelium_group) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) |
 | [Netsh Abuse](netsh_abuse) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall) | [Defense Evasion](/tags/#defense-evasion) |
-| [Office 365 Detections](office_365_detections) | [Password Guessing](/tags/#password-guessing), [Cloud Account](/tags/#cloud-account), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Modify Authentication Process](/tags/#modify-authentication-process), [Brute Force](/tags/#brute-force), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Remote Email Collection](/tags/#remote-email-collection) | [Credential Access](/tags/#credential-access) |
-| [Orangeworm Attack Group](orangeworm_attack_group) | [Service Execution](/tags/#service-execution), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Windows Service](/tags/#windows-service) | [Execution](/tags/#execution) |
-| [PetitPotam NTLM Relay on Active Directory Certificate Services](petitpotam_ntlm_relay_on_active_directory_certificate_services) | [Forced Authentication](/tags/#forced-authentication), [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) |
-| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns) | [PowerShell](/tags/#powershell), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | [Execution](/tags/#execution) |
-| [PrintNightmare CVE-2021-34527](printnightmare_cve-2021-34527) | [Print Processors](/tags/#print-processors), [Rundll32](/tags/#rundll32), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Persistence](/tags/#persistence) |
-| [Prohibited Traffic Allowed or Protocol Mismatch](prohibited_traffic_allowed_or_protocol_mismatch) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Drive-by Compromise](/tags/#drive-by-compromise), [Remote Services](/tags/#remote-services), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Web Protocols](/tags/#web-protocols) | [Lateral Movement](/tags/#lateral-movement) |
-| [ProxyShell](proxyshell) | [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [PowerShell](/tags/#powershell) | [Persistence](/tags/#persistence) |
-| [Ransomware](ransomware) | [Archive via Utility](/tags/#archive-via-utility), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Service Stop](/tags/#service-stop), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [CMSTP](/tags/#cmstp), [File Deletion](/tags/#file-deletion), [Data Destruction](/tags/#data-destruction), [User Execution](/tags/#user-execution), [Automated Exfiltration](/tags/#automated-exfiltration), [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Account Access Removal](/tags/#account-access-removal), [Service Execution](/tags/#service-execution), [Visual Basic](/tags/#visual-basic), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Modify Registry](/tags/#modify-registry), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Scheduled Task](/tags/#scheduled-task), [Rename System Utilities](/tags/#rename-system-utilities), [Web Protocols](/tags/#web-protocols), [Msiexec](/tags/#msiexec) | [Collection](/tags/#collection) |
+| [Office 365 Detections](office_365_detections) | [Email Forwarding Rule](/tags/#email-forwarding-rule) | [Collection](/tags/#collection) |
+| [Orangeworm Attack Group](orangeworm_attack_group) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) |
+| [PetitPotam NTLM Relay on Active Directory Certificate Services](petitpotam_ntlm_relay_on_active_directory_certificate_services) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) |
+| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | [Persistence](/tags/#persistence) |
+| [PrintNightmare CVE-2021-34527](printnightmare_cve-2021-34527) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
+| [Prohibited Traffic Allowed or Protocol Mismatch](prohibited_traffic_allowed_or_protocol_mismatch) | [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) |
+| [ProxyShell](proxyshell) | [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) |
+| [Ransomware](ransomware) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
 | [Ransomware Cloud](ransomware_cloud) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |
-| [Remcos](remcos) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Masquerading](/tags/#masquerading), [Port Monitors](/tags/#port-monitors), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Application Shimming](/tags/#application-shimming), [Screen Capture](/tags/#screen-capture), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Privilege Escalation](/tags/#privilege-escalation) |
-| [Revil Ransomware](revil_ransomware) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [User Execution](/tags/#user-execution), [Modify Registry](/tags/#modify-registry), [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion) |
-| [Router and Infrastructure Security](router_and_infrastructure_security) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [ARP Cache Poisoning](/tags/#arp-cache-poisoning), [Man-in-the-Middle](/tags/#man-in-the-middle), [TFTP Boot](/tags/#tftp-boot), [Traffic Duplication](/tags/#traffic-duplication) | [Initial Access](/tags/#initial-access) |
-| [Ryuk Ransomware](ryuk_ransomware) | [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Data Destruction](/tags/#data-destruction), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Command Shell](/tags/#windows-command-shell), [Scheduled Task](/tags/#scheduled-task), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) |
+| [Remcos](remcos) | [Screen Capture](/tags/#screen-capture) | [Collection](/tags/#collection) |
+| [Revil Ransomware](revil_ransomware) | [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion) |
+| [Router and Infrastructure Security](router_and_infrastructure_security) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Traffic Duplication](/tags/#traffic-duplication) | [Initial Access](/tags/#initial-access) |
+| [Ryuk Ransomware](ryuk_ransomware) | [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) |
 | [SQL Injection](sql_injection) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
-| [SamSam Ransomware](samsam_ransomware) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping), [Service Stop](/tags/#service-stop), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Account Access Removal](/tags/#account-access-removal), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Software Deployment Tools](/tags/#software-deployment-tools), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Rundll32](/tags/#rundll32), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Defense Evasion](/tags/#defense-evasion) |
-| [Silver Sparrow](silver_sparrow) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Launch Agent](/tags/#launch-agent), [Data Staged](/tags/#data-staged) | [Command And Control](/tags/#command-and-control) |
-| [Spearphishing Attachments](spearphishing_attachments) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Security Account Manager](/tags/#security-account-manager), [Spearphishing Link](/tags/#spearphishing-link) | [Initial Access](/tags/#initial-access) |
+| [SamSam Ransomware](samsam_ransomware) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |
+| [Silver Sparrow](silver_sparrow) | [Data Staged](/tags/#data-staged) | [Collection](/tags/#collection) |
+| [Spearphishing Attachments](spearphishing_attachments) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) |
 | [Suspicious AWS Login Activities](suspicious_aws_login_activities) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious AWS S3 Activities](suspicious_aws_s3_activities) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) |
 | [Suspicious AWS Traffic]() | None | None |
 | [Suspicious Cloud Authentication Activities](suspicious_cloud_authentication_activities) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) |
-| [Suspicious Cloud Instance Activities](suspicious_cloud_instance_activities) | [Cloud Accounts](/tags/#cloud-accounts), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Defense Evasion](/tags/#defense-evasion) |
+| [Suspicious Cloud Instance Activities](suspicious_cloud_instance_activities) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Exfiltration](/tags/#exfiltration) |
 | [Suspicious Cloud Provisioning Activities](suspicious_cloud_provisioning_activities) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) |
-| [Suspicious Cloud User Activities](suspicious_cloud_user_activities) | [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | [Discovery](/tags/#discovery) |
-| [Suspicious Command-Line Executions](suspicious_command-line_executions) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Rename System Utilities](/tags/#rename-system-utilities) | [Execution](/tags/#execution) |
+| [Suspicious Cloud User Activities](suspicious_cloud_user_activities) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) |
+| [Suspicious Command-Line Executions](suspicious_command-line_executions) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious Compiled HTML Activity](suspicious_compiled_html_activity) | [Compiled HTML File](/tags/#compiled-html-file) | [Defense Evasion](/tags/#defense-evasion) |
-| [Suspicious DNS Traffic](suspicious_dns_traffic) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) |
+| [Suspicious DNS Traffic](suspicious_dns_traffic) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) |
 | [Suspicious Emails](suspicious_emails) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) |
 | [Suspicious GCP Storage Activities](suspicious_gcp_storage_activities) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) |
-| [Suspicious MSHTA Activity](suspicious_mshta_activity) | [Mshta](/tags/#mshta), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | [Defense Evasion](/tags/#defense-evasion) |
+| [Suspicious MSHTA Activity](suspicious_mshta_activity) | [Mshta](/tags/#mshta) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious Okta Activity](suspicious_okta_activity) | [Default Accounts](/tags/#default-accounts) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious Regsvcs Regasm Activity](suspicious_regsvcs_regasm_activity) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious Regsvr32 Activity](suspicious_regsvr32_activity) | [Regsvr32](/tags/#regsvr32) | [Defense Evasion](/tags/#defense-evasion) |
-| [Suspicious Rundll32 Activity](suspicious_rundll32_activity) | [Rundll32](/tags/#rundll32), [LSASS Memory](/tags/#lsass-memory), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
-| [Suspicious WMI Use](suspicious_wmi_use) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription), [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [Privilege Escalation](/tags/#privilege-escalation) |
-| [Suspicious Windows Registry Activities](suspicious_windows_registry_activities) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Masquerading](/tags/#masquerading), [Port Monitors](/tags/#port-monitors), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Application Shimming](/tags/#application-shimming), [Screen Capture](/tags/#screen-capture), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Privilege Escalation](/tags/#privilege-escalation) |
-| [Suspicious Zoom Child Processes](suspicious_zoom_child_processes) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Rename System Utilities](/tags/#rename-system-utilities) | [Execution](/tags/#execution) |
-| [Trickbot](trickbot) | [Domain Account](/tags/#domain-account), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [Malicious File](/tags/#malicious-file), [Bypass User Account Control](/tags/#bypass-user-account-control), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Regsvr32](/tags/#regsvr32), [IP Addresses](/tags/#ip-addresses), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Scheduled Task](/tags/#scheduled-task), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Discovery](/tags/#discovery) |
-| [Trusted Developer Utilities Proxy Execution](trusted_developer_utilities_proxy_execution) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
+| [Suspicious Rundll32 Activity](suspicious_rundll32_activity) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) |
+| [Suspicious WMI Use](suspicious_wmi_use) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [Execution](/tags/#execution) |
+| [Suspicious Windows Registry Activities](suspicious_windows_registry_activities) | [Application Shimming](/tags/#application-shimming) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Suspicious Zoom Child Processes](suspicious_zoom_child_processes) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Trickbot](trickbot) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) |
+| [Trusted Developer Utilities Proxy Execution](trusted_developer_utilities_proxy_execution) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | [Defense Evasion](/tags/#defense-evasion) |
 | [Trusted Developer Utilities Proxy Execution MSBuild](trusted_developer_utilities_proxy_execution_msbuild) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
-| [Unusual Processes](unusual_processes) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping), [Service Stop](/tags/#service-stop), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Account Access Removal](/tags/#account-access-removal), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Software Deployment Tools](/tags/#software-deployment-tools), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Rundll32](/tags/#rundll32), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Defense Evasion](/tags/#defense-evasion) |
+| [Unusual Processes](unusual_processes) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
 | [Use of Cleartext Protocols]() | None | None |
 | [Windows DNS SIGRed CVE-2020-1350](windows_dns_sigred_cve-2020-1350) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) |
-| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Bypass User Account Control](/tags/#bypass-user-account-control), [Modify Registry](/tags/#modify-registry), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows Discovery Techniques](windows_discovery_techniques) | [Valid Accounts](/tags/#valid-accounts), [Account Discovery](/tags/#account-discovery), [Domain Policy Modification](/tags/#domain-policy-modification), [Trusted Relationship](/tags/#trusted-relationship), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Gather Victim Org Information](/tags/#gather-victim-org-information), [Active Scanning](/tags/#active-scanning), [Gather Victim Host Information](/tags/#gather-victim-host-information), [System Service Discovery](/tags/#system-service-discovery), [Query Registry](/tags/#query-registry), [Network Service Scanning](/tags/#network-service-scanning), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Discovery](/tags/#process-discovery), [File and Directory Discovery](/tags/#file-and-directory-discovery), [Software Discovery](/tags/#software-discovery), [Software](/tags/#software), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Network Share Discovery](/tags/#network-share-discovery), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Credentials](/tags/#credentials), [Domain Properties](/tags/#domain-properties), [Network Trust Dependencies](/tags/#network-trust-dependencies), [Account Manipulation](/tags/#account-manipulation), [Vulnerability Scanning](/tags/#vulnerability-scanning), [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows File Extension and Association Abuse](windows_file_extension_and_association_abuse) | [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [Rundll32](/tags/#rundll32), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) |
-| [Windows Log Manipulation](windows_log_manipulation) | [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Impact](/tags/#impact) |
-| [Windows Persistence Techniques](windows_persistence_techniques) | [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Establish Accounts](/tags/#establish-accounts), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Rogue Domain Controller](/tags/#rogue-domain-controller), [Domain Policy Modification](/tags/#domain-policy-modification), [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Port Monitors](/tags/#port-monitors), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Application Shimming](/tags/#application-shimming), [Windows Service](/tags/#windows-service), [Scheduled Task](/tags/#scheduled-task), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Persistence](/tags/#persistence) |
-| [Windows Privilege Escalation](windows_privilege_escalation) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Accessibility Features](/tags/#accessibility-features), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) |
-| [Windows Service Abuse](windows_service_abuse) | [Service Execution](/tags/#service-execution), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Windows Service](/tags/#windows-service) | [Execution](/tags/#execution) |
-| [XMRig](xmrig) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping), [Service Stop](/tags/#service-stop), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Account Access Removal](/tags/#account-access-removal), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Software Deployment Tools](/tags/#software-deployment-tools), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Rundll32](/tags/#rundll32), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Defense Evasion](/tags/#defense-evasion) |
+| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) |
+| [Windows Discovery Techniques](windows_discovery_techniques) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Process Injection](/tags/#process-injection), [Hijack Execution Flow](/tags/#hijack-execution-flow) | [Persistence](/tags/#persistence) |
+| [Windows File Extension and Association Abuse](windows_file_extension_and_association_abuse) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
+| [Windows Log Manipulation](windows_log_manipulation) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
+| [Windows Persistence Techniques](windows_persistence_techniques) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
+| [Windows Privilege Escalation](windows_privilege_escalation) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) |
+| [Windows Service Abuse](windows_service_abuse) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) |
+| [XMRig](xmrig) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) |
@@ -0,0 +1,686 @@
+---
+title: "Ransomware Investigate and Contain"
+last_modified_at: 2018-02-04
+toc: true
+toc_label: ""
+tags:
+  - Response
+  - Splunk SOAR
+  - Carbon Black Response
+  - LDAP
+  - Palo Alto Networks Firewall
+  - WildFire
+  - Cylance
+---
+
+[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success}
+
+#### Description
+
+This playbook investigates and contains ransomware detected on endpoints.
+
+- **Type**: Response
+- **Product**: Splunk SOAR
+- **Apps**: [Carbon Black Response](https://splunkbase.splunk.com/apps/#/search/Carbon Black Response/product/soar), [LDAP](https://splunkbase.splunk.com/apps/#/search/LDAP/product/soar), [Palo Alto Networks Firewall](https://splunkbase.splunk.com/apps/#/search/Palo Alto Networks Firewall/product/soar), [WildFire](https://splunkbase.splunk.com/apps/#/search/WildFire/product/soar), [Cylance](https://splunkbase.splunk.com/apps/#/search/Cylance/product/soar)
+- **Last Updated**: 2018-02-04
+- **Author**: Philip Royer, Splunk
+- **ID**: fc0edc96-ff2b-48b0-9f6f-63da3783fd63
+
+#### Associated Detections
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+* [Conti Common Exec parameter](/detections/TTP/conti_common_exec_parameter)
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+#### How To Implement
+This playbook requires the Splunk SOAR apps for Palo Alto Networks Firewalls, Palo Alto Wildfire, LDAP, and Carbon Black Response.
+
+#### Playbooks
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/ransomware_investigate_and_contain.png)
+
+#### Required field
+* ComputerName
+* Username
+
+
+#### Reference
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/ransomware_investigate_and_contain.yml) \| *version*: **1**
@@ -5,6 +5,7 @@ categories:
  - Application
 last_modified_at: 2017-09-12
 toc: true
+toc_label: ""
 tags:
  - TTP
  - Splunk Enterprise
@@ -5,6 +5,7 @@ categories:
  - Network
 last_modified_at: 2017-09-13
 toc: true
+toc_label: ""
 tags:
  - TTP
  - Splunk Enterprise
@@ -5,6 +5,7 @@ categories:
  - Application
 last_modified_at: 2017-09-15
 toc: true
+toc_label: ""
 tags:
  - Hunting
  - Splunk Enterprise
@@ -5,6 +5,7 @@ categories:
  - Application
 last_modified_at: 2017-09-19
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - Splunk Enterprise
@@ -5,6 +5,7 @@ categories:
  - Network
 last_modified_at: 2017-09-20
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - T1498.002
@@ -37,8 +38,8 @@ The search is used to identify attempts to use your DNS Infrastructure for DDoS

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1498.002](https://attack.mitre.org/techniques/T1498/002/) | Reflection Amplification | Impact |


@@ -5,6 +5,7 @@ categories:
  - Web
 last_modified_at: 2017-09-23
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1082
@@ -37,8 +38,8 @@ This search looks for specific GET or HEAD requests to web servers that are indi

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1082](https://attack.mitre.org/techniques/T1082/) | System Information Discovery | Discovery |


@@ -5,6 +5,7 @@ categories:
  - Web
 last_modified_at: 2017-09-23
 toc: true
+toc_label: ""
 tags:
  - TTP
  - Splunk Enterprise
@@ -5,6 +5,7 @@ categories:
  - Web
 last_modified_at: 2017-09-23
 toc: true
+toc_label: ""
 tags:
  - TTP
  - Splunk Enterprise
@@ -5,6 +5,7 @@ categories:
  - Network
 last_modified_at: 2017-10-13
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - Splunk Enterprise
@@ -5,6 +5,7 @@ categories:
  - Application
 last_modified_at: 2018-01-05
 toc: true
+toc_label: ""
 tags:
  - TTP
  - Splunk Enterprise
@@ -5,6 +5,7 @@ categories:
  - Cloud
 last_modified_at: 2018-05-07
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - Splunk Enterprise
@@ -5,6 +5,7 @@ categories:
  - Network
 last_modified_at: 2018-06-01
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1095
@@ -37,8 +38,8 @@ This search looks for outbound ICMP packets with a packet size larger than 1,000

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1095](https://attack.mitre.org/techniques/T1095/) | Non-Application Layer Protocol | Command And Control |


@@ -5,6 +5,7 @@ categories:
  - Cloud
 last_modified_at: 2018-06-28
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - T1530
@@ -36,8 +37,8 @@ This search looks at S3 bucket-access logs and detects new or previously unseen

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection |


@@ -5,6 +5,7 @@ categories:
  - Cloud
 last_modified_at: 2018-10-12
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - Splunk Security Analytics for AWS
@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2018-10-23
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1047
@@ -36,8 +37,8 @@ This search looks for the creation of WMI permanent event subscriptions.

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2018-10-23
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1047
@@ -36,8 +37,8 @@ This search looks for the creation of WMI temporary event subscriptions.

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |


@@ -5,6 +5,7 @@ categories:
  - Cloud
 last_modified_at: 2018-11-27
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - T1530
@@ -36,8 +37,8 @@ This search detects users creating spikes in API activity related to deletion of

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2018-12-03
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1047
@@ -35,8 +36,8 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2018-12-03
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1070
@@ -35,8 +36,8 @@ The fsutil.exe application is a legitimate Windows utility used to perform tasks

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion |


@@ -5,6 +5,7 @@ categories:
  - Application
 last_modified_at: 2018-12-06
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - Splunk Enterprise
@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2018-12-14
 toc: true
+toc_label: ""
 tags:
  - TTP
  - Splunk Enterprise
@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2018-12-14
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1486
@@ -35,8 +36,8 @@ The search looks for a file named &#34;test.txt&#34; written to the windows syst

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2019-01-25
 toc: true
+toc_label: ""
 tags:
  - TTP
  - Splunk Enterprise
@@ -5,6 +5,7 @@ categories:
  - Application
 last_modified_at: 2019-04-01
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1082
@@ -37,8 +38,8 @@ This search looks for suspicious processes on all systems labeled as web servers

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1082](https://attack.mitre.org/techniques/T1082/) | System Information Discovery | Discovery |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2019-05-08
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - Splunk Enterprise
@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2019-12-03
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1003.001
@@ -34,8 +35,8 @@ This search looks for reading lsass memory consistent with credential dumping.

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2019-12-03
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1003.001
@@ -34,8 +35,8 @@ This search looks for reading loaded Images unique to credential dumping with Mi

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2019-12-06
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1003.001
@@ -34,8 +35,8 @@ Detect memory dumping of the LSASS process.

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2019-12-06
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1003.001
@@ -34,8 +35,8 @@ Detect remote thread creation into LSASS consistent with credential dumping.

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2019-12-10
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1003.003
@@ -35,8 +36,8 @@ Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy.

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1003.003](https://attack.mitre.org/techniques/T1003/003/) | NTDS | Credential Access |


@@ -5,6 +5,7 @@ categories:
  - Network
 last_modified_at: 2020-01-22
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - T1071.004
@@ -37,8 +38,8 @@ This search allows you to identify DNS requests that are unusually large for the

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1071.004](https://attack.mitre.org/techniques/T1071/004/) | DNS | Command And Control |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-02-03
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1003.001
@@ -34,8 +35,8 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-02-07
 toc: true
+toc_label: ""
 tags:
  - TTP
  - Splunk Enterprise
@@ -5,6 +5,7 @@ categories:
  - Cloud
 last_modified_at: 2020-02-20
 toc: true
+toc_label: ""
 tags:
  - Hunting
  - T1525
@@ -35,8 +36,8 @@ This searches show information on uploaded containers including source user, ima

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1525](https://attack.mitre.org/techniques/T1525/) | Implant Internal Image | Persistence |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-02-21
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1003.001
@@ -35,8 +36,8 @@ Detect the usage of comsvcs.dll for dumping the lsass process.

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-03-16
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1068
@@ -37,8 +38,8 @@ This search looks for child processes of spoolsv.exe. This activity is associate

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-03-16
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - Splunk Enterprise
@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-03-16
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1047
@@ -35,8 +36,8 @@ The following analytic identifies `WmiPrvSE.exe` spawning a process. This typica

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-03-16
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1047
@@ -35,8 +36,8 @@ This search looks for scripts launched via WMI.

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-03-16
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - Splunk Enterprise
@@ -5,6 +5,7 @@ categories:
  - Cloud
 last_modified_at: 2020-04-15
 toc: true
+toc_label: ""
 tags:
  - Hunting
  - T1526
@@ -36,8 +37,8 @@ This search provides information of unauthenticated requests via user agent, and

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery |


@@ -5,6 +5,7 @@ categories:
  - Cloud
 last_modified_at: 2020-04-15
 toc: true
+toc_label: ""
 tags:
  - Hunting
  - T1526
@@ -36,8 +37,8 @@ This search provides detection information on unauthenticated requests against K

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-05-20
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - T1068
@@ -35,8 +36,8 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation |


@@ -5,6 +5,7 @@ categories:
  - Cloud
 last_modified_at: 2020-05-28
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - Splunk Security Analytics for AWS
@@ -5,6 +5,7 @@ categories:
  - Cloud
 last_modified_at: 2020-05-28
 toc: true
+toc_label: ""
 tags:
  - Hunting
  - Splunk Security Analytics for AWS
@@ -5,6 +5,7 @@ categories:
  - Cloud
 last_modified_at: 2020-06-23
 toc: true
+toc_label: ""
 tags:
  - Hunting
  - Splunk Enterprise
@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-07-03
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1574.009
@@ -37,8 +38,8 @@ The detection Detect Path Interception By Creation Of program exe is detecting t

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1574.009](https://attack.mitre.org/techniques/T1574/009/) | Path Interception by Unquoted Path | Persistence, Privilege Escalation, Defense Evasion |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-07-06
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1136.001
@@ -34,8 +35,8 @@ This search detects accounts that were created and deleted in a short time perio

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1136.001](https://attack.mitre.org/techniques/T1136/001/) | Local Account | Persistence |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-07-06
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1070.001
@@ -34,8 +35,8 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1070.001](https://attack.mitre.org/techniques/T1070/001/) | Clear Windows Event Logs | Defense Evasion |


@@ -5,6 +5,7 @@ categories:
  - Network
 last_modified_at: 2020-07-07
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - T1021.001
@@ -37,8 +38,8 @@ This search looks for network traffic on TCP/3389, the default port used by remo

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-07-08
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1136.001
@@ -35,8 +36,8 @@ This search looks for newly created accounts that have been elevated to local ad

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1136.001](https://attack.mitre.org/techniques/T1136/001/) | Local Account | Persistence |


@@ -5,6 +5,7 @@ categories:
  - Cloud
 last_modified_at: 2020-07-17
 toc: true
+toc_label: ""
 tags:
  - Hunting
  - T1526
@@ -36,8 +37,8 @@ This search provides information of unauthenticated requests via user agent, and

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1562.001
@@ -36,8 +37,8 @@ This search looks for attempts to stop security-related services on the endpoint

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - T1078.003
@@ -37,8 +38,8 @@ This search detects user accounts that have been locked out a relatively high nu

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1078.003](https://attack.mitre.org/techniques/T1078/003/) | Local Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |


@@ -5,6 +5,7 @@ categories:
  - Network
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1071.002
@@ -38,8 +39,8 @@ This search looks for outbound SMB connections made by hosts within your network

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1071.002](https://attack.mitre.org/techniques/T1071/002/) | File Transfer Protocols | Command And Control |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1566.001
@@ -37,8 +38,8 @@ This search looks for execution of process `outlook.exe` where the process is wr

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1059.003
@@ -35,8 +36,8 @@ This search looks for the execution of the cscript.exe or wscript.exe processes,

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1072
@@ -39,8 +40,8 @@ This search looks for specific command-line arguments that may indicate the exec

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1072](https://attack.mitre.org/techniques/T1072/) | Software Deployment Tools | Execution, Lateral Movement |


@@ -5,6 +5,7 @@ categories:
  - Application
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1114.001
@@ -37,8 +38,8 @@ The search looks at the change-analysis data model and detects email files creat

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1114.001](https://attack.mitre.org/techniques/T1114/001/) | Local Email Collection | Collection |


@@ -5,6 +5,7 @@ categories:
  - Application
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - T1114.002
@@ -37,8 +38,8 @@ This search looks for an increase of data transfers from your email server to yo

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1114.002](https://attack.mitre.org/techniques/T1114/002/) | Remote Email Collection | Collection |


@@ -5,6 +5,7 @@ categories:
  - Network
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - T1071.004
@@ -37,8 +38,8 @@ This search identifies DNS query failures by counting the number of DNS response

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1071.004](https://attack.mitre.org/techniques/T1071/004/) | DNS | Command And Control |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - T1569.002
@@ -37,8 +38,8 @@ This search looks for the first and last time a Windows service is seen running

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1569.002](https://attack.mitre.org/techniques/T1569/002/) | Service Execution | Execution |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1222.001
@@ -35,8 +36,8 @@ Attackers leverage an existing Windows binary, attrib.exe, to mark specific as h

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1222.001](https://attack.mitre.org/techniques/T1222/001/) | Windows File and Directory Permissions Modification | Defense Evasion |


@@ -5,6 +5,7 @@ categories:
  - Network
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - T1114.002
@@ -37,8 +38,8 @@ This search looks for an increase of data transfers from your email server to yo

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1114.002](https://attack.mitre.org/techniques/T1114/002/) | Remote Email Collection | Collection |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1059.001
@@ -36,8 +37,8 @@ This search looks for PowerShell processes started with parameters used to bypas

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |


@@ -5,6 +5,7 @@ categories:
  - Application
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1078.001
@@ -38,8 +39,8 @@ This search detects Okta login failures due to bad credentials for multiple user

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |


@@ -5,6 +5,7 @@ categories:
  - Application
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - T1078.001
@@ -38,8 +39,8 @@ Detect Okta user lockout events

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |


@@ -5,6 +5,7 @@ categories:
  - Application
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - T1078.001
@@ -38,8 +39,8 @@ Detect failed Okta SSO events

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |


@@ -5,6 +5,7 @@ categories:
  - Application
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - T1078.001
@@ -38,8 +39,8 @@ This search detects logins from the same user from different cities in a 24 hour

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1546.008
@@ -36,8 +37,8 @@ Microsoft Windows contains accessibility features that can be launched with a ke

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1546.008](https://attack.mitre.org/techniques/T1546/008/) | Accessibility Features | Privilege Escalation, Persistence |


@@ -5,6 +5,7 @@ categories:
  - Network
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1048
@@ -38,8 +39,8 @@ This search looks for network traffic defined by port and transport layer protoc

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration |


@@ -5,6 +5,7 @@ categories:
  - Network
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - T1048.003
@@ -37,8 +38,8 @@ This search looks for network traffic on common ports where a higher layer proto

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration |


@@ -5,6 +5,7 @@ categories:
  - Network
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1021.001
@@ -38,8 +39,8 @@ This search looks for RDP application network traffic and filters any source/des

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - Hunting
  - T1021.001
@@ -37,8 +38,8 @@ This search looks for the remote desktop process mstsc.exe running on systems up

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1543.003
@@ -36,8 +37,8 @@ This search looks for arguments to sc.exe indicating the creation or modificatio

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation |


@@ -5,6 +5,7 @@ categories:
  - Endpoint
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1053.005
@@ -37,8 +38,8 @@ This search looks for flags passed to schtasks.exe on the command-line that indi

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation |


@@ -5,6 +5,7 @@ categories:
  - Web
 last_modified_at: 2020-07-21
 toc: true
+toc_label: ""
 tags:
  - TTP
  - T1190
@@ -37,8 +38,8 @@ This search looks for long URLs that have several SQL commands visible within th

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |


@@ -5,6 +5,7 @@ categories:
  - Network
 last_modified_at: 2020-07-22
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - T1021.002
@@ -37,8 +38,8 @@ This search looks for spikes in the number of Server Message Block (SMB) traffic

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement |


@@ -5,6 +5,7 @@ categories:
  - Network
 last_modified_at: 2020-07-22
 toc: true
+toc_label: ""
 tags:
  - Anomaly
  - T1021.002
@@ -37,8 +38,8 @@ This search uses the Machine Learning Toolkit (MLTK) to identify spikes in the n

 #### ATT&CK

-| ID          | Technique   | Tactic       |
-| ----------- | ----------- |--------------|
+| ID          | Technique   | Tactic         |
+| ----------- | ----------- | -------------- |
 | [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement |


--- a/Show More
+++ b/Show More