diff --git a/bin/doc_gen.py b/bin/doc_gen.py index 0dc4aa02ca..1206d67eee 100644 --- a/bin/doc_gen.py +++ b/bin/doc_gen.py @@ -10,6 +10,8 @@ import datetime from stix2 import FileSystemSource from stix2 import Filter + + def get_all_techniques(projects_path): path_cti = path.join(projects_path,'cti/enterprise-attack') fs = FileSystemSource(path_cti) @@ -109,11 +111,6 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de sto_to_kill_chain_phases[story] = set(detection['tags']['kill_chain_phases']) if 'mitre_attacks' in detection: - if story in sto_to_mitre_attacks.keys(): - for mitre_attack in detection['mitre_attacks']: - if mitre_attack not in sto_to_mitre_attacks[story]: - sto_to_mitre_attacks[story].append(mitre_attack) - else: sto_to_mitre_attacks[story] = detection['mitre_attacks'] # add the enrich objects to the story @@ -198,14 +195,6 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de f.write(output) messages.append("doc_gen.py wrote _page for: {0} structure to: {1}".format(category['name'], output_path)) - # write index updated metrics - template = j2_env.get_template('doc_index_markdown.j2') - output_path = path.join(OUTPUT_DIR + '/index.markdown') - output = template.render(detection_count=len(sorted_detections), story_count=len(sorted_stories)) - with open(output_path, 'w', encoding="utf-8") as f: - f.write(output) - messages.append("doc_gen.py wrote site index page to: {0}".format(output_path)) - # write stories listing markdown template = j2_env.get_template('doc_story_page_markdown.j2') output_path = path.join(OUTPUT_DIR + '/_pages/stories.md') @@ -329,6 +318,71 @@ def generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, messag messages.append("doc_gen.py wrote {0} detections documentation in mediawiki to: {1}".format(len(detections),output_path)) return sorted_detections, messages + +def generate_doc_playbooks(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, sorted_detections, messages, VERBOSE): + manifest_files = [] + for root, dirs, files in walk(REPO_PATH + '/playbooks/'): + for file in files: + if file.endswith(".yml"): + manifest_files.append((path.join(root, file))) + + playbooks = [] + for manifest_file in manifest_files: + detection_yaml = dict() + if VERBOSE: + print("processing manifest {0}".format(manifest_file)) + + with open(manifest_file, 'r') as stream: + try: + object = list(yaml.safe_load_all(stream))[0] + except yaml.YAMLError as exc: + print(exc) + print("Error reading {0}".format(manifest_file)) + sys.exit(1) + + playbooks.append(object) + + sorted_playbooks = sorted(playbooks, key=lambda i: i['name']) + + j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), # nosemgrep + trim_blocks=False, autoescape=True) + + # write markdown + template = j2_env.get_template('doc_playbooks_markdown.j2') + for playbook in sorted_playbooks: + file_name = playbook['name'].lower().replace(" ","_") + '.md' + output_path = path.join(OUTPUT_DIR + '/_playbooks/' + file_name) + output = template.render(playbook=playbook, detections=sorted_detections, time=datetime.datetime.now()) + with open(output_path, 'w', encoding="utf-8") as f: + f.write(output) + messages.append("doc_gen.py wrote {0} playbook documentation in markdown to: {1}".format(len(sorted_playbooks),OUTPUT_DIR + '/_playbooks/')) + + # write markdown detection page + template = j2_env.get_template('doc_playbooks_page_markdown.j2') + output_path = path.join(OUTPUT_DIR + '/_pages/playbooks.md') + output = template.render(playbooks=sorted_playbooks, detections=sorted_detections, time=datetime.datetime.now()) + with open(output_path, 'w', encoding="utf-8") as f: + f.write(output) + messages.append("doc_gen.py wrote playbooks.md page to: {0}".format(output_path)) + + return sorted_playbooks, messages + + +def generate_doc_index(OUTPUT_DIR, TEMPLATE_PATH, sorted_detections, sorted_stories, sorted_playbooks, messages, VERBOSE): + + j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), # nosemgrep + trim_blocks=False, autoescape=True) + + # write index updated metrics + template = j2_env.get_template('doc_index_markdown.j2') + output_path = path.join(OUTPUT_DIR + '/index.markdown') + output = template.render(detection_count=len(sorted_detections), story_count=len(sorted_stories), playbook_count=len(sorted_playbooks)) + with open(output_path, 'w', encoding="utf-8") as f: + f.write(output) + messages.append("doc_gen.py wrote site index page to: {0}".format(output_path)) + + return messages + if __name__ == "__main__": # grab arguments @@ -355,6 +409,8 @@ if __name__ == "__main__": messages = [] sorted_detections, messages = generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, techniques, messages, VERBOSE) sorted_stories, messages = generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, techniques, sorted_detections, messages, VERBOSE) + sorted_playbooks, messages = generate_doc_playbooks(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, sorted_detections, messages, VERBOSE) + messages = generate_doc_index(OUTPUT_DIR, TEMPLATE_PATH, sorted_detections, sorted_stories, sorted_playbooks, messages, VERBOSE) # print all the messages from generation for m in messages: diff --git a/bin/jinja2_templates/doc_detection_page_markdown.j2 b/bin/jinja2_templates/doc_detection_page_markdown.j2 index 90950a64c5..921cd615b6 100644 --- a/bin/jinja2_templates/doc_detection_page_markdown.j2 +++ b/bin/jinja2_templates/doc_detection_page_markdown.j2 @@ -8,12 +8,12 @@ sidebar: nav: "detections" --- -| Name | Technique | Tactic | Type | -| ----------- | ----------- |--------------| --------------| +| Name | Technique | Type | +| --------| --------- |------------| {%- for detection in detections -%} {% if detection.mitre_attacks %} -| [{{ detection.name }}](/{{ detection.kind }}/{{ detection.name | lower | replace(' ', '_') }}/) | {% for attack in detection.mitre_attacks -%} [{{ attack.technique }}](/tags/#{{ attack.technique | lower | replace(" ", "-") }}){% if not loop.last -%}, {% endif -%}{%- endfor %} | [{{ detection.mitre_attacks[0].tactic[0] }}](/tags/#{{ detection.mitre_attacks[0].tactic[0] | lower | replace(" ", "-") }}) | {{ detection.type }} | +| [{{ detection.name }}](/{{ detection.kind }}/{{ detection.name | lower | replace(' ', '_') }}/) | {% for attack in detection.mitre_attacks -%} [{{ attack.technique }}](/tags/#{{ attack.technique | lower | replace(" ", "-") }}){% if not loop.last -%}, {% endif -%}{%- endfor %} | {{ detection.type }} | {%- else %} -| [{{ detection.name }}]() | None | None | {{ detection.type }} | +| [{{ detection.name }}]() | None | {{ detection.type }} | {%- endif -%} {%- endfor -%} diff --git a/bin/jinja2_templates/doc_detections_markdown.j2 b/bin/jinja2_templates/doc_detections_markdown.j2 index 892e76badb..b51709bb09 100644 --- a/bin/jinja2_templates/doc_detections_markdown.j2 +++ b/bin/jinja2_templates/doc_detections_markdown.j2 @@ -10,6 +10,7 @@ categories: - {{detection.kind|capitalize}} last_modified_at: {{detection.date}} toc: true +toc_label: "" tags: - {{ detection.type }} {%- for attack in detection.mitre_attacks %} @@ -51,8 +52,8 @@ We have not been able to test, simulate or build datasets for it, use at your ow {% if detection.mitre_attacks %} #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | {% for attack in detection.mitre_attacks -%} {% if attack.technique_id -%} {%- set sub_technique = attack.technique_id.split('.') -%}{%- if sub_technique | length > 1 -%} diff --git a/bin/jinja2_templates/doc_index_markdown.j2 b/bin/jinja2_templates/doc_index_markdown.j2 index 5c36060ed8..68c229da49 100644 --- a/bin/jinja2_templates/doc_index_markdown.j2 +++ b/bin/jinja2_templates/doc_index_markdown.j2 @@ -9,7 +9,7 @@ header: actions: - label: "Download" url: "https://splunkbase.splunk.com/app/3449/" -excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with over 400+ detections for Splunk." +excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **{{ detection_count }}** detections for Splunk." feature_row: - image_path: /static/feature_detection.png alt: "customizable" @@ -28,7 +28,7 @@ feature_row: - image_path: /static/feature_playbooks.png alt: "100% free" title: "Playbooks" - excerpt: "See all **2** sets of steps 🐾 to automatically response to a threat." + excerpt: "See all **{{ playbook_count }}** sets of steps 🐾 to automatically response to a threat." url: "/playbooks" btn_class: "btn--primary" btn_label: "Explore" @@ -44,9 +44,9 @@ This project gives you access to our repository of Analytic Stories that are sec [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} ## [Detection Coverage](https://mitremap.splunkresearch.com/) 🗺 -Below is a snapshot in time of what technique we currently have some detection coverage for. The darker the shade of blue the more detections we have for this particular technique. This map is automatically updated on every release and generated from the [generate-coverage-map.py](https://github.com/splunk/security_content/blob/develop/bin/generate-coverage-map.py). +Below is a snapshot in time of what technique we currently have some detection coverage for. The darker the shade of blue the more detections we have for this particular technique. -![](mitre-map/coverage.png) +[![](mitre-map/coverage.png)](https://mitremap.splunkresearch.com/) ## View Our Content 🔎 diff --git a/bin/jinja2_templates/doc_navigation_markdown.j2 b/bin/jinja2_templates/doc_navigation_markdown.j2 index ed52ebe4a5..34cc094162 100644 --- a/bin/jinja2_templates/doc_navigation_markdown.j2 +++ b/bin/jinja2_templates/doc_navigation_markdown.j2 @@ -37,3 +37,10 @@ stories: - title: {{ category }} url: /stories/{{ category | lower | replace(" ", "_") }}/ {%- endfor %} +playbooks: + - title: "Type" + children: + - title: "Response" + url: /tags/#response/ + - title: "Investigation" + url: /tags/#investigation/ diff --git a/bin/jinja2_templates/doc_playbooks_markdown.j2 b/bin/jinja2_templates/doc_playbooks_markdown.j2 new file mode 100644 index 0000000000..f99a53fa6b --- /dev/null +++ b/bin/jinja2_templates/doc_playbooks_markdown.j2 @@ -0,0 +1,57 @@ +--- +title: "{{playbook.name}}" +last_modified_at: {{playbook.date}} +toc: true +toc_label: "" +tags: + - {{ playbook.type }} +{%- for product in playbook.tags.product %} + - {{ product }} +{%- endfor -%} +{%- for app in playbook.app_list %} + - {{ app }} +{%- endfor %} +--- + +[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success} + +#### Description + +{{ playbook.description }} + +- **Type**: {{ playbook.type }} +- **Product**: {{ playbook.tags.product|join(', ') }} +- **Apps**: {% for app in playbook.app_list %}[{{ app }}](https://splunkbase.splunk.com/apps/#/search/{{ app }}/product/soar){% if not loop.last %}, {% endif %}{%-endfor %} +- **Last Updated**: {{ playbook.date }} +- **Author**: {{playbook.author}} +- **ID**: {{ playbook.id }} + +#### Associated Detections +{% for detection in playbook.tags.detections -%} +{% for d in detections -%} +{% if d.name == detection -%} +* [{{ detection }}](/detections/{{ d.type }}/{{detection|lower|replace(" ", "_")}}) +{% endif %} +{% endfor %} +{% endfor %} + +#### How To Implement +{{ playbook.how_to_implement}} + +#### Playbooks +![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/{{ playbook.name | lower | replace(" ", "_")}}.png) + +#### Required field +{% for field in playbook.tags.playbook_fields -%} +* {{ field }} +{% endfor %} + +#### Reference +{% if playbook.references %} +{% for reference in playbook.references -%} +* [{{ reference }}]({{ reference }}) +{% endfor %} +{% endif %} + + +[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/{{ playbook.name | lower | replace (" ", "_") }}.yml) \| *version*: **{{playbook.version}}** diff --git a/bin/jinja2_templates/doc_playbooks_page_markdown.j2 b/bin/jinja2_templates/doc_playbooks_page_markdown.j2 new file mode 100644 index 0000000000..e50af7ff47 --- /dev/null +++ b/bin/jinja2_templates/doc_playbooks_page_markdown.j2 @@ -0,0 +1,15 @@ +--- +title: "Playbooks" +layout: collection +author_profile: false +permalink: /playbooks/ +classes: wide +sidebar: + nav: "playbooks" +--- + +| Name | Detections | Type | +| --------| ---------- | ----------- | +{% for playbook in playbooks -%} +| [{{ playbook.name }}](/playbooks/{{ playbook.name|lower|replace(' ', '_') }}/)|{% for detection in playbook.tags.detections -%}{% for d in detections -%}{% if d.name == detection -%}[{{ detection }}](/detections/{{ d.type }}/{{detection|lower|replace(" ", "_")}}){% endif -%}{%- endfor -%}{%- endfor -%} | {{ playbook.type }} | +{%- endfor -%} diff --git a/bin/jinja2_templates/doc_stories_markdown.j2 b/bin/jinja2_templates/doc_stories_markdown.j2 index ba374814b0..9ffefefe7f 100644 --- a/bin/jinja2_templates/doc_stories_markdown.j2 +++ b/bin/jinja2_templates/doc_stories_markdown.j2 @@ -2,6 +2,7 @@ title: "{{story.name}}" last_modified_at: {{story.date}} toc: true +toc_label: "" tags: {%- for product in story.tags.product %} - {{ product }} diff --git a/docs/CNAME b/docs/CNAME index 17c520cf21..900af49d09 100644 --- a/docs/CNAME +++ b/docs/CNAME @@ -1 +1 @@ -splunkresearch.com \ No newline at end of file +research.splunk.com \ No newline at end of file diff --git a/docs/Gemfile.lock b/docs/Gemfile.lock index 8c4b1e0d67..5b85b86074 100644 --- a/docs/Gemfile.lock +++ b/docs/Gemfile.lock @@ -25,11 +25,11 @@ GEM em-websocket (0.5.2) eventmachine (>= 0.12.9) http_parser.rb (~> 0.6.0) - ethon (0.14.0) + ethon (0.15.0) ffi (>= 1.15.0) eventmachine (1.2.7) execjs (2.8.1) - faraday (1.7.1) + faraday (1.8.0) faraday-em_http (~> 1.0) faraday-em_synchrony (~> 1.0) faraday-excon (~> 1.1) @@ -52,8 +52,8 @@ GEM filesize (0.2.0) forwardable-extended (2.6.0) gemoji (3.0.1) - github-pages (219) - github-pages-health-check (= 1.17.7) + github-pages (220) + github-pages-health-check (= 1.17.9) jekyll (= 3.9.0) jekyll-avatar (= 0.7.0) jekyll-coffeescript (= 1.1.1) @@ -96,7 +96,7 @@ GEM nokogiri (>= 1.10.4, < 2.0) rouge (= 3.26.0) terminal-table (~> 1.4) - github-pages-health-check (1.17.7) + github-pages-health-check (1.17.9) addressable (~> 2.3) dnsruby (~> 1.60) octokit (~> 4.0) @@ -242,6 +242,8 @@ GEM jekyll-seo-tag (~> 2.1) multi_json (1.15.0) multipart-post (2.1.1) + nokogiri (1.12.5-x86_64-darwin) + racc (~> 1.4) nokogiri (1.12.5-x86_64-linux) racc (~> 1.4) octokit (4.21.0) @@ -278,16 +280,17 @@ GEM ethon (>= 0.9.0) tzinfo (2.0.4) concurrent-ruby (~> 1.0) - tzinfo-data (1.2021.1) + tzinfo-data (1.2021.3) tzinfo (>= 1.0.0) unf (0.1.4) unf_ext - unf_ext (0.0.7.7) - unicode-display_width (1.7.0) + unf_ext (0.0.8) + unicode-display_width (1.8.0) verbal_expressions (0.1.5) webrick (1.7.0) PLATFORMS + x86_64-darwin-20 x86_64-linux DEPENDENCIES @@ -303,4 +306,4 @@ DEPENDENCIES webrick (~> 1.7) BUNDLED WITH - 2.2.27 + 2.2.29 diff --git a/docs/_config.yml b/docs/_config.yml index f834b25a9b..d86163add5 100644 --- a/docs/_config.yml +++ b/docs/_config.yml @@ -88,6 +88,9 @@ collections: stories: output: true permalink: /:collection/:path/ + playbooks: + output: true + permalink: /:collection/:path/ defaults: # _docs @@ -121,7 +124,17 @@ defaults: share: true related: true toc: true - + # _playbooks + - scope: + path: "_playbooks" + type: playbooks + values: + layout: single + author_profile: false + comments: true + share: true + related: true + toc: true category_archive: type: liquid path: /categories/ @@ -135,4 +148,3 @@ analytics: google: tracking_id: "G-83V3JSYPS7" anonymize_ip: false # default - diff --git a/docs/_data/navigation.yml b/docs/_data/navigation.yml index 2beef9bdeb..3939ead730 100644 --- a/docs/_data/navigation.yml +++ b/docs/_data/navigation.yml @@ -84,4 +84,11 @@ stories: - title: Malware url: /stories/malware/ - title: Vulnerability - url: /stories/vulnerability/ \ No newline at end of file + url: /stories/vulnerability/ +playbooks: + - title: "Type" + children: + - title: "Response" + url: /tags/#response/ + - title: "Investigation" + url: /tags/#investigation/ \ No newline at end of file diff --git a/docs/_pages/adversary_tactics.md b/docs/_pages/adversary_tactics.md index 5341b41ba9..ab9dfdc2ce 100644 --- a/docs/_pages/adversary_tactics.md +++ b/docs/_pages/adversary_tactics.md @@ -10,52 +10,52 @@ sidebar: | Name | Technique | Tactic | | ----------- | ----------- |--------------| -| [Active Directory Discovery](/stories/active_directory_discovery/) | [Domain Account](/tags/#domain-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote System Discovery](/tags/#remote-system-discovery), [Domain Groups](/tags/#domain-groups), [Password Policy Discovery](/tags/#password-policy-discovery), [Local Groups](/tags/#local-groups), [System Owner/User Discovery](/tags/#system-owner/user-discovery), [Local Account](/tags/#local-account), [System Network Connections Discovery](/tags/#system-network-connections-discovery) | [Discovery](/tags/#discovery) | +| [Active Directory Discovery](/stories/active_directory_discovery/) | [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) | | [Active Directory Password Spraying](/stories/active_directory_password_spraying/) | [Password Spraying](/tags/#password-spraying) | [Credential Access](/tags/#credential-access) | -| [BITS Jobs](/stories/bits_jobs/) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Defense Evasion](/tags/#defense-evasion) | +| [BITS Jobs](/stories/bits_jobs/) | [BITS Jobs](/tags/#bits-jobs) | [Defense Evasion](/tags/#defense-evasion) | | [Baron Samedit CVE-2021-3156](/stories/baron_samedit_cve-2021-3156/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) | -| [Cobalt Strike](/stories/cobalt_strike/) | [Archive via Utility](/tags/#archive-via-utility), [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service), [Process Injection](/tags/#process-injection), [File Transfer Protocols](/tags/#file-transfer-protocols), [Regsvr32](/tags/#regsvr32), [Mshta](/tags/#mshta), [Service Execution](/tags/#service-execution), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Rundll32](/tags/#rundll32), [Scheduled Task](/tags/#scheduled-task), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Web Shell](/tags/#web-shell), [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Web Protocols](/tags/#web-protocols), [Remote System Discovery](/tags/#remote-system-discovery) | [Collection](/tags/#collection) | -| [Collection and Staging](/stories/collection_and_staging/) | [Archive via Utility](/tags/#archive-via-utility), [Local Email Collection](/tags/#local-email-collection), [Remote Email Collection](/tags/#remote-email-collection), [Masquerading](/tags/#masquerading) | [Collection](/tags/#collection) | -| [Command and Control](/stories/command_and_control/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) | -| [Credential Dumping](/stories/credential_dumping/) | [LSASS Memory](/tags/#lsass-memory), [Process Injection](/tags/#process-injection), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Access Token Manipulation](/tags/#access-token-manipulation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Modify Authentication Process](/tags/#modify-authentication-process), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Account Discovery](/tags/#account-discovery), [Password Policy Discovery](/tags/#password-policy-discovery), [Unsecured Credentials](/tags/#unsecured-credentials), [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager), [NTDS](/tags/#ntds), [Kerberoasting](/tags/#kerberoasting), [PowerShell](/tags/#powershell) | [Credential Access](/tags/#credential-access) | +| [Cobalt Strike](/stories/cobalt_strike/) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | +| [Collection and Staging](/stories/collection_and_staging/) | [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) | +| [Command and Control](/stories/command_and_control/) | [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) | +| [Credential Dumping](/stories/credential_dumping/) | [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) | | [DNS Hijacking](/stories/dns_hijacking/) | [Drive-by Compromise](/tags/#drive-by-compromise) | [Initial Access](/tags/#initial-access) | -| [Data Exfiltration](/stories/data_exfiltration/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) | +| [Data Exfiltration](/stories/data_exfiltration/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | [Exfiltration](/tags/#exfiltration) | | [Deobfuscate-Decode Files or Information](/stories/deobfuscate-decode_files_or_information/) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information) | [Defense Evasion](/tags/#defense-evasion) | -| [Detect Zerologon Attack](/stories/detect_zerologon_attack/) | [Exploitation of Remote Services](/tags/#exploitation-of-remote-services), [LSASS Memory](/tags/#lsass-memory), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Lateral Movement](/tags/#lateral-movement) | -| [Disabling Security Tools](/stories/disabling_security_tools/) | [Install Root Certificate](/tags/#install-root-certificate), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Windows Service](/tags/#windows-service), [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion) | -| [Domain Trust Discovery](/stories/domain_trust_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | +| [Detect Zerologon Attack](/stories/detect_zerologon_attack/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | +| [Disabling Security Tools](/stories/disabling_security_tools/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | +| [Domain Trust Discovery](/stories/domain_trust_discovery/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | | [F5 TMUI RCE CVE-2020-5902](/stories/f5_tmui_rce_cve-2020-5902/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | -| [HAFNIUM Group](/stories/hafnium_group/) | [PowerShell](/tags/#powershell), [Web Shell](/tags/#web-shell), [Local Account](/tags/#local-account), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [LSASS Memory](/tags/#lsass-memory), [Remote Email Collection](/tags/#remote-email-collection), [NTDS](/tags/#ntds), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Execution](/tags/#execution) | -| [Ingress Tool Transfer](/stories/ingress_tool_transfer/) | [PowerShell](/tags/#powershell), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [OS Credential Dumping](/tags/#os-credential-dumping), [Remote Services](/tags/#remote-services), [Screen Capture](/tags/#screen-capture), [Audio Capture](/tags/#audio-capture), [Remote Service Session Hijacking](/tags/#remote-service-session-hijacking), [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Impair Defenses](/tags/#impair-defenses) | [Execution](/tags/#execution) | -| [Lateral Movement](/stories/lateral_movement/) | [Pass the Hash](/tags/#pass-the-hash), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [Kerberoasting](/tags/#kerberoasting), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Scheduled Task](/tags/#scheduled-task) | [Defense Evasion](/tags/#defense-evasion) | -| [Malicious PowerShell](/stories/malicious_powershell/) | [PowerShell](/tags/#powershell), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [OS Credential Dumping](/tags/#os-credential-dumping), [Remote Services](/tags/#remote-services), [Screen Capture](/tags/#screen-capture), [Audio Capture](/tags/#audio-capture), [Remote Service Session Hijacking](/tags/#remote-service-session-hijacking), [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Impair Defenses](/tags/#impair-defenses) | [Execution](/tags/#execution) | -| [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities/) | [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [Rundll32](/tags/#rundll32), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) | +| [HAFNIUM Group](/stories/hafnium_group/) | [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) | +| [Ingress Tool Transfer](/stories/ingress_tool_transfer/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control) | +| [Lateral Movement](/stories/lateral_movement/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | +| [Malicious PowerShell](/stories/malicious_powershell/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | [Reconnaissance](/tags/#reconnaissance) | +| [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities/) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | | [Meterpreter](/stories/meterpreter/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) | -| [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444/) | [Control Panel](/tags/#control-panel), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | -| [NOBELIUM Group](/stories/nobelium_group/) | [Archive via Utility](/tags/#archive-via-utility), [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service), [Process Injection](/tags/#process-injection), [File Transfer Protocols](/tags/#file-transfer-protocols), [Regsvr32](/tags/#regsvr32), [Mshta](/tags/#mshta), [Service Execution](/tags/#service-execution), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Rundll32](/tags/#rundll32), [Scheduled Task](/tags/#scheduled-task), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Web Shell](/tags/#web-shell), [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Web Protocols](/tags/#web-protocols), [Remote System Discovery](/tags/#remote-system-discovery) | [Collection](/tags/#collection) | -| [PetitPotam NTLM Relay on Active Directory Certificate Services](/stories/petitpotam_ntlm_relay_on_active_directory_certificate_services/) | [Forced Authentication](/tags/#forced-authentication), [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) | -| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns/) | [PowerShell](/tags/#powershell), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | [Execution](/tags/#execution) | -| [ProxyShell](/stories/proxyshell/) | [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [PowerShell](/tags/#powershell) | [Persistence](/tags/#persistence) | +| [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | +| [NOBELIUM Group](/stories/nobelium_group/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | +| [PetitPotam NTLM Relay on Active Directory Certificate Services](/stories/petitpotam_ntlm_relay_on_active_directory_certificate_services/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) | +| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | [Persistence](/tags/#persistence) | +| [ProxyShell](/stories/proxyshell/) | [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) | | [SQL Injection](/stories/sql_injection/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | -| [Silver Sparrow](/stories/silver_sparrow/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Launch Agent](/tags/#launch-agent), [Data Staged](/tags/#data-staged) | [Command And Control](/tags/#command-and-control) | -| [Spearphishing Attachments](/stories/spearphishing_attachments/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Security Account Manager](/tags/#security-account-manager), [Spearphishing Link](/tags/#spearphishing-link) | [Initial Access](/tags/#initial-access) | -| [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions/) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Rename System Utilities](/tags/#rename-system-utilities) | [Execution](/tags/#execution) | +| [Silver Sparrow](/stories/silver_sparrow/) | [Data Staged](/tags/#data-staged) | [Collection](/tags/#collection) | +| [Spearphishing Attachments](/stories/spearphishing_attachments/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | +| [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions/) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | | [Suspicious Compiled HTML Activity](/stories/suspicious_compiled_html_activity/) | [Compiled HTML File](/tags/#compiled-html-file) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious DNS Traffic](/stories/suspicious_dns_traffic/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) | +| [Suspicious DNS Traffic](/stories/suspicious_dns_traffic/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) | | [Suspicious Emails](/stories/suspicious_emails/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | -| [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity/) | [Mshta](/tags/#mshta), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity/) | [Mshta](/tags/#mshta) | [Defense Evasion](/tags/#defense-evasion) | | [Suspicious Okta Activity](/stories/suspicious_okta_activity/) | [Default Accounts](/tags/#default-accounts) | [Defense Evasion](/tags/#defense-evasion) | | [Suspicious Regsvcs Regasm Activity](/stories/suspicious_regsvcs_regasm_activity/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [Defense Evasion](/tags/#defense-evasion) | | [Suspicious Regsvr32 Activity](/stories/suspicious_regsvr32_activity/) | [Regsvr32](/tags/#regsvr32) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity/) | [Rundll32](/tags/#rundll32), [LSASS Memory](/tags/#lsass-memory), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious WMI Use](/stories/suspicious_wmi_use/) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription), [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [Privilege Escalation](/tags/#privilege-escalation) | -| [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Masquerading](/tags/#masquerading), [Port Monitors](/tags/#port-monitors), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Application Shimming](/tags/#application-shimming), [Screen Capture](/tags/#screen-capture), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Privilege Escalation](/tags/#privilege-escalation) | -| [Suspicious Zoom Child Processes](/stories/suspicious_zoom_child_processes/) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Rename System Utilities](/tags/#rename-system-utilities) | [Execution](/tags/#execution) | -| [Trusted Developer Utilities Proxy Execution](/stories/trusted_developer_utilities_proxy_execution/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious WMI Use](/stories/suspicious_wmi_use/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [Execution](/tags/#execution) | +| [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities/) | [Application Shimming](/tags/#application-shimming) | [Privilege Escalation](/tags/#privilege-escalation) | +| [Suspicious Zoom Child Processes](/stories/suspicious_zoom_child_processes/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) | +| [Trusted Developer Utilities Proxy Execution](/stories/trusted_developer_utilities_proxy_execution/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | [Defense Evasion](/tags/#defense-evasion) | | [Trusted Developer Utilities Proxy Execution MSBuild](/stories/trusted_developer_utilities_proxy_execution_msbuild/) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | | [Windows DNS SIGRed CVE-2020-1350](/stories/windows_dns_sigred_cve-2020-1350/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) | -| [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Bypass User Account Control](/tags/#bypass-user-account-control), [Modify Registry](/tags/#modify-registry), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) | -| [Windows Discovery Techniques](/stories/windows_discovery_techniques/) | [Valid Accounts](/tags/#valid-accounts), [Account Discovery](/tags/#account-discovery), [Domain Policy Modification](/tags/#domain-policy-modification), [Trusted Relationship](/tags/#trusted-relationship), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Gather Victim Org Information](/tags/#gather-victim-org-information), [Active Scanning](/tags/#active-scanning), [Gather Victim Host Information](/tags/#gather-victim-host-information), [System Service Discovery](/tags/#system-service-discovery), [Query Registry](/tags/#query-registry), [Network Service Scanning](/tags/#network-service-scanning), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Discovery](/tags/#process-discovery), [File and Directory Discovery](/tags/#file-and-directory-discovery), [Software Discovery](/tags/#software-discovery), [Software](/tags/#software), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Network Share Discovery](/tags/#network-share-discovery), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Credentials](/tags/#credentials), [Domain Properties](/tags/#domain-properties), [Network Trust Dependencies](/tags/#network-trust-dependencies), [Account Manipulation](/tags/#account-manipulation), [Vulnerability Scanning](/tags/#vulnerability-scanning), [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) | -| [Windows Log Manipulation](/stories/windows_log_manipulation/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Impact](/tags/#impact) | -| [Windows Persistence Techniques](/stories/windows_persistence_techniques/) | [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Establish Accounts](/tags/#establish-accounts), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Rogue Domain Controller](/tags/#rogue-domain-controller), [Domain Policy Modification](/tags/#domain-policy-modification), [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Port Monitors](/tags/#port-monitors), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Application Shimming](/tags/#application-shimming), [Windows Service](/tags/#windows-service), [Scheduled Task](/tags/#scheduled-task), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Persistence](/tags/#persistence) | -| [Windows Privilege Escalation](/stories/windows_privilege_escalation/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Accessibility Features](/tags/#accessibility-features), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) | \ No newline at end of file +| [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | +| [Windows Discovery Techniques](/stories/windows_discovery_techniques/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Process Injection](/tags/#process-injection), [Hijack Execution Flow](/tags/#hijack-execution-flow) | [Persistence](/tags/#persistence) | +| [Windows Log Manipulation](/stories/windows_log_manipulation/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | +| [Windows Persistence Techniques](/stories/windows_persistence_techniques/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | +| [Windows Privilege Escalation](/stories/windows_privilege_escalation/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) | \ No newline at end of file diff --git a/docs/_pages/best_practices.md b/docs/_pages/best_practices.md index f56ad96ba8..6114be8754 100644 --- a/docs/_pages/best_practices.md +++ b/docs/_pages/best_practices.md @@ -12,6 +12,6 @@ sidebar: | ----------- | ----------- |--------------| | [Asset Tracking]() | None | None | | [Monitor for Updates]() | None | None | -| [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Drive-by Compromise](/tags/#drive-by-compromise), [Remote Services](/tags/#remote-services), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Web Protocols](/tags/#web-protocols) | [Lateral Movement](/tags/#lateral-movement) | -| [Router and Infrastructure Security](/stories/router_and_infrastructure_security/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [ARP Cache Poisoning](/tags/#arp-cache-poisoning), [Man-in-the-Middle](/tags/#man-in-the-middle), [TFTP Boot](/tags/#tftp-boot), [Traffic Duplication](/tags/#traffic-duplication) | [Initial Access](/tags/#initial-access) | +| [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch/) | [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) | +| [Router and Infrastructure Security](/stories/router_and_infrastructure_security/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Traffic Duplication](/tags/#traffic-duplication) | [Initial Access](/tags/#initial-access) | | [Use of Cleartext Protocols]() | None | None | \ No newline at end of file diff --git a/docs/_pages/cloud_security.md b/docs/_pages/cloud_security.md index 3dafe9a591..4ecc062563 100644 --- a/docs/_pages/cloud_security.md +++ b/docs/_pages/cloud_security.md @@ -10,24 +10,24 @@ sidebar: | Name | Technique | Tactic | | ----------- | ----------- |--------------| -| [AWS Cross Account Activity](/stories/aws_cross_account_activity/) | [Valid Accounts](/tags/#valid-accounts), [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material) | [Defense Evasion](/tags/#defense-evasion) | -| [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation/) | [Cloud Accounts](/tags/#cloud-accounts), [Cloud Account](/tags/#cloud-account), [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [Brute Force](/tags/#brute-force), [Account Manipulation](/tags/#account-manipulation), [Cloud Groups](/tags/#cloud-groups) | [Defense Evasion](/tags/#defense-evasion) | +| [AWS Cross Account Activity](/stories/aws_cross_account_activity/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material) | [Defense Evasion](/tags/#defense-evasion) | +| [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation/) | [Cloud Account](/tags/#cloud-account) | [Persistence](/tags/#persistence) | | [AWS Network ACL Activity](/stories/aws_network_acl_activity/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | [Defense Evasion](/tags/#defense-evasion) | | [AWS Security Hub Alerts]() | None | None | | [AWS User Monitoring](/stories/aws_user_monitoring/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) | -| [Cloud Cryptomining](/stories/cloud_cryptomining/) | [Cloud Accounts](/tags/#cloud-accounts), [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) | -| [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse/) | [Valid Accounts](/tags/#valid-accounts), [LSASS Memory](/tags/#lsass-memory), [Cloud Account](/tags/#cloud-account), [Modify Authentication Process](/tags/#modify-authentication-process), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Defense Evasion](/tags/#defense-evasion) | +| [Cloud Cryptomining](/stories/cloud_cryptomining/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) | +| [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) | | [Container Implantation Monitoring and Investigation](/stories/container_implantation_monitoring_and_investigation/) | [Implant Internal Image](/tags/#implant-internal-image) | [Persistence](/tags/#persistence) | -| [Dev Sec Ops](/stories/dev_sec_ops/) | [Malicious Image](/tags/#malicious-image), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Exploitation for Credential Access](/tags/#exploitation-for-credential-access), [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Execution](/tags/#execution) | +| [Dev Sec Ops](/stories/dev_sec_ops/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) | | [GCP Cross Account Activity](/stories/gcp_cross_account_activity/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | | [Kubernetes Scanning Activity](/stories/kubernetes_scanning_activity/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) | | [Kubernetes Sensitive Object Access Activity]() | None | None | -| [Office 365 Detections](/stories/office_365_detections/) | [Password Guessing](/tags/#password-guessing), [Cloud Account](/tags/#cloud-account), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Modify Authentication Process](/tags/#modify-authentication-process), [Brute Force](/tags/#brute-force), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Remote Email Collection](/tags/#remote-email-collection) | [Credential Access](/tags/#credential-access) | +| [Office 365 Detections](/stories/office_365_detections/) | [Email Forwarding Rule](/tags/#email-forwarding-rule) | [Collection](/tags/#collection) | | [Suspicious AWS Login Activities](/stories/suspicious_aws_login_activities/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) | | [Suspicious AWS S3 Activities](/stories/suspicious_aws_s3_activities/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) | | [Suspicious AWS Traffic]() | None | None | | [Suspicious Cloud Authentication Activities](/stories/suspicious_cloud_authentication_activities/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious Cloud Instance Activities](/stories/suspicious_cloud_instance_activities/) | [Cloud Accounts](/tags/#cloud-accounts), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious Cloud Instance Activities](/stories/suspicious_cloud_instance_activities/) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Exfiltration](/tags/#exfiltration) | | [Suspicious Cloud Provisioning Activities](/stories/suspicious_cloud_provisioning_activities/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious Cloud User Activities](/stories/suspicious_cloud_user_activities/) | [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | [Discovery](/tags/#discovery) | +| [Suspicious Cloud User Activities](/stories/suspicious_cloud_user_activities/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | | [Suspicious GCP Storage Activities](/stories/suspicious_gcp_storage_activities/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) | \ No newline at end of file diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md index f7dee0bdac..25fa3d4300 100644 --- a/docs/_pages/detections.md +++ b/docs/_pages/detections.md @@ -8,641 +8,642 @@ sidebar: nav: "detections" --- -| Name | Technique | Tactic | Type | -| ----------- | ----------- |--------------| --------------| -| [7zip CommandLine To SMB Share Path](/endpoint/7zip_commandline_to_smb_share_path/) | [Archive via Utility](/tags/#archive-via-utility) | [Collection](/tags/#collection) | Hunting | -| [AWS Create Policy Version to allow all resources](/cloud/aws_create_policy_version_to_allow_all_resources/) | [Cloud Accounts](/tags/#cloud-accounts) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [AWS CreateAccessKey](/cloud/aws_createaccesskey/) | [Cloud Account](/tags/#cloud-account) | [Persistence](/tags/#persistence) | Hunting | -| [AWS CreateLoginProfile](/cloud/aws_createloginprofile/) | [Cloud Account](/tags/#cloud-account) | [Persistence](/tags/#persistence) | TTP | -| [AWS Cross Account Activity From Previously Unseen Account]() | None | None | Anomaly | -| [AWS Detect Users creating keys with encrypt policy without MFA](/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) | TTP | -| [AWS Detect Users with KMS keys performing encryption S3](/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) | Anomaly | -| [AWS ECR Container Scanning Findings High](/cloud/aws_ecr_container_scanning_findings_high/) | [Malicious Image](/tags/#malicious-image) | [Execution](/tags/#execution) | TTP | -| [AWS ECR Container Scanning Findings Low Informational Unknown](/cloud/aws_ecr_container_scanning_findings_low_informational_unknown/) | [Malicious Image](/tags/#malicious-image) | [Execution](/tags/#execution) | Hunting | -| [AWS ECR Container Scanning Findings Medium](/cloud/aws_ecr_container_scanning_findings_medium/) | [Malicious Image](/tags/#malicious-image) | [Execution](/tags/#execution) | Anomaly | -| [AWS ECR Container Upload Outside Business Hours](/cloud/aws_ecr_container_upload_outside_business_hours/) | [Malicious Image](/tags/#malicious-image) | [Execution](/tags/#execution) | Anomaly | -| [AWS ECR Container Upload Unknown User](/cloud/aws_ecr_container_upload_unknown_user/) | [Malicious Image](/tags/#malicious-image) | [Execution](/tags/#execution) | Anomaly | -| [AWS Excessive Security Scanning](/cloud/aws_excessive_security_scanning/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) | TTP | -| [AWS IAM AccessDenied Discovery Events](/cloud/aws_iam_accessdenied_discovery_events/) | [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery) | [Discovery](/tags/#discovery) | Anomaly | -| [AWS IAM Assume Role Policy Brute Force](/cloud/aws_iam_assume_role_policy_brute_force/) | [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [Brute Force](/tags/#brute-force) | [Discovery](/tags/#discovery) | TTP | -| [AWS IAM Delete Policy](/cloud/aws_iam_delete_policy/) | [Account Manipulation](/tags/#account-manipulation) | [Persistence](/tags/#persistence) | Hunting | -| [AWS IAM Failure Group Deletion](/cloud/aws_iam_failure_group_deletion/) | [Account Manipulation](/tags/#account-manipulation) | [Persistence](/tags/#persistence) | Anomaly | -| [AWS IAM Successful Group Deletion](/cloud/aws_iam_successful_group_deletion/) | [Cloud Groups](/tags/#cloud-groups), [Account Manipulation](/tags/#account-manipulation) | [Discovery](/tags/#discovery) | Hunting | -| [AWS Network Access Control List Created with All Open Ports](/cloud/aws_network_access_control_list_created_with_all_open_ports/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [AWS Network Access Control List Deleted](/cloud/aws_network_access_control_list_deleted/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [AWS SAML Access by Provider User and Principal](/cloud/aws_saml_access_by_provider_user_and_principal/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [AWS SAML Update identity provider](/cloud/aws_saml_update_identity_provider/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [AWS SetDefaultPolicyVersion](/cloud/aws_setdefaultpolicyversion/) | [Cloud Accounts](/tags/#cloud-accounts) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [AWS UpdateLoginProfile](/cloud/aws_updateloginprofile/) | [Cloud Account](/tags/#cloud-account) | [Persistence](/tags/#persistence) | TTP | -| [Abnormally High Number Of Cloud Infrastructure API Calls](/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls/) | [Cloud Accounts](/tags/#cloud-accounts) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [Abnormally High Number Of Cloud Instances Destroyed](/cloud/abnormally_high_number_of_cloud_instances_destroyed/) | [Cloud Accounts](/tags/#cloud-accounts) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [Abnormally High Number Of Cloud Instances Launched](/cloud/abnormally_high_number_of_cloud_instances_launched/) | [Cloud Accounts](/tags/#cloud-accounts) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [Abnormally High Number Of Cloud Security Group API Calls](/cloud/abnormally_high_number_of_cloud_security_group_api_calls/) | [Cloud Accounts](/tags/#cloud-accounts) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [Access LSASS Memory for Dump Creation](/endpoint/access_lsass_memory_for_dump_creation/) | [LSASS Memory](/tags/#lsass-memory) | [Credential Access](/tags/#credential-access) | TTP | -| [Account Discovery With Net App](/endpoint/account_discovery_with_net_app/) | [Domain Account](/tags/#domain-account) | [Discovery](/tags/#discovery) | TTP | -| [Add DefaultUser And Password In Registry](/endpoint/add_defaultuser_and_password_in_registry/) | [Credentials in Registry](/tags/#credentials-in-registry) | [Credential Access](/tags/#credential-access) | Anomaly | -| [AdsiSearcher Account Discovery](/endpoint/adsisearcher_account_discovery/) | [Domain Account](/tags/#domain-account) | [Discovery](/tags/#discovery) | TTP | -| [Allow File And Printing Sharing In Firewall](/endpoint/allow_file_and_printing_sharing_in_firewall/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Allow Inbound Traffic By Firewall Rule Registry](/endpoint/allow_inbound_traffic_by_firewall_rule_registry/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | [Lateral Movement](/tags/#lateral-movement) | TTP | -| [Allow Inbound Traffic In Firewall Rule](/endpoint/allow_inbound_traffic_in_firewall_rule/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | [Lateral Movement](/tags/#lateral-movement) | TTP | -| [Allow Network Discovery In Firewall](/endpoint/allow_network_discovery_in_firewall/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Allow Operation with Consent Admin](/endpoint/allow_operation_with_consent_admin/) | [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [Amazon EKS Kubernetes Pod scan detection](/cloud/amazon_eks_kubernetes_pod_scan_detection/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [Amazon EKS Kubernetes cluster scan detection](/cloud/amazon_eks_kubernetes_cluster_scan_detection/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [Anomalous usage of 7zip](/endpoint/anomalous_usage_of_7zip/) | [Archive via Utility](/tags/#archive-via-utility) | [Collection](/tags/#collection) | Anomaly | -| [Any Powershell DownloadFile](/endpoint/any_powershell_downloadfile/) | [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) | TTP | -| [Any Powershell DownloadString](/endpoint/any_powershell_downloadstring/) | [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) | TTP | -| [Applying Stolen Credentials via Mimikatz modules](/endpoint/applying_stolen_credentials_via_mimikatz_modules/) | [Process Injection](/tags/#process-injection), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Access Token Manipulation](/tags/#access-token-manipulation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Modify Authentication Process](/tags/#modify-authentication-process), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Applying Stolen Credentials via PowerSploit modules](/endpoint/applying_stolen_credentials_via_powersploit_modules/) | [Process Injection](/tags/#process-injection), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Access Token Manipulation](/tags/#access-token-manipulation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Assessment of Credential Strength via DSInternals modules](/endpoint/assessment_of_credential_strength_via_dsinternals_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Account Discovery](/tags/#account-discovery), [Password Policy Discovery](/tags/#password-policy-discovery), [Unsecured Credentials](/tags/#unsecured-credentials), [Credentials from Password Stores](/tags/#credentials-from-password-stores) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Attacker Tools On Endpoint](/endpoint/attacker_tools_on_endpoint/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Attempt To Add Certificate To Untrusted Store](/endpoint/attempt_to_add_certificate_to_untrusted_store/) | [Install Root Certificate](/tags/#install-root-certificate) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Attempt To Disable Services](/endpoint/attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) | TTP | -| [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Attempt To delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) | TTP | -| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) | TTP | -| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager) | [Credential Access](/tags/#credential-access) | TTP | -| [Auto Admin Logon Registry Entry](/endpoint/auto_admin_logon_registry_entry/) | [Credentials in Registry](/tags/#credentials-in-registry) | [Credential Access](/tags/#credential-access) | TTP | -| [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | [Impact](/tags/#impact) | TTP | -| [BITS Job Persistence](/endpoint/bits_job_persistence/) | [BITS Jobs](/tags/#bits-jobs) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [BITSAdmin Download File](/endpoint/bitsadmin_download_file/) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Batch File Write to System32](/endpoint/batch_file_write_to_system32/) | [Malicious File](/tags/#malicious-file) | [Execution](/tags/#execution) | TTP | -| [Bcdedit Command Back To Normal Mode Boot](/endpoint/bcdedit_command_back_to_normal_mode_boot/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | [Impact](/tags/#impact) | TTP | -| [CHCP Command Execution](/endpoint/chcp_command_execution/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Execution](/tags/#execution) | TTP | -| [CMD Echo Pipe - Escalation](/endpoint/cmd_echo_pipe_-_escalation/) | [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service) | [Execution](/tags/#execution) | TTP | -| [CMLUA Or CMSTPLUA UAC Bypass](/endpoint/cmlua_or_cmstplua_uac_bypass/) | [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [CertUtil Download With URLCache and Split Arguments](/endpoint/certutil_download_with_urlcache_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control) | TTP | -| [CertUtil Download With VerifyCtl and Split Arguments](/endpoint/certutil_download_with_verifyctl_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control) | TTP | -| [CertUtil With Decode Argument](/endpoint/certutil_with_decode_argument/) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Certutil exe certificate extraction]() | None | None | TTP | -| [Change To Safe Mode With Network Config](/endpoint/change_to_safe_mode_with_network_config/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | [Impact](/tags/#impact) | TTP | -| [Check Elevated CMD using whoami](/endpoint/check_elevated_cmd_using_whoami/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) | TTP | -| [Child Processes of Spoolsv exe](/endpoint/child_processes_of_spoolsv_exe/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [Circle CI Disable Security Job](/cloud/circle_ci_disable_security_job/) | [Compromise Client Software Binary](/tags/#compromise-client-software-binary) | [Persistence](/tags/#persistence) | Anomaly | -| [Circle CI Disable Security Step](/cloud/circle_ci_disable_security_step/) | [Compromise Client Software Binary](/tags/#compromise-client-software-binary) | [Persistence](/tags/#persistence) | Anomaly | -| [Clear Unallocated Sector Using Cipher App](/endpoint/clear_unallocated_sector_using_cipher_app/) | [File Deletion](/tags/#file-deletion) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Clop Common Exec Parameter](/endpoint/clop_common_exec_parameter/) | [User Execution](/tags/#user-execution) | [Execution](/tags/#execution) | TTP | -| [Clop Ransomware Known Service Name](/endpoint/clop_ransomware_known_service_name/) | [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) | TTP | -| [Cloud API Calls From Previously Unseen User Roles](/cloud/cloud_api_calls_from_previously_unseen_user_roles/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [Cloud Compute Instance Created By Previously Unseen User](/cloud/cloud_compute_instance_created_by_previously_unseen_user/) | [Cloud Accounts](/tags/#cloud-accounts) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [Cloud Compute Instance Created In Previously Unused Region](/cloud/cloud_compute_instance_created_in_previously_unused_region/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [Cloud Compute Instance Created With Previously Unseen Image]() | None | None | Anomaly | -| [Cloud Compute Instance Created With Previously Unseen Instance Type]() | None | None | Anomaly | -| [Cloud Instance Modified By Previously Unseen User](/cloud/cloud_instance_modified_by_previously_unseen_user/) | [Cloud Accounts](/tags/#cloud-accounts) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [Cloud Provisioning Activity From Previously Unseen City](/cloud/cloud_provisioning_activity_from_previously_unseen_city/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [Cloud Provisioning Activity From Previously Unseen Country](/cloud/cloud_provisioning_activity_from_previously_unseen_country/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [Cloud Provisioning Activity From Previously Unseen IP Address](/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [Cloud Provisioning Activity From Previously Unseen Region](/cloud/cloud_provisioning_activity_from_previously_unseen_region/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [Cmdline Tool Not Executed In CMD Shell](/endpoint/cmdline_tool_not_executed_in_cmd_shell/) | [JavaScript](/tags/#javascript) | [Execution](/tags/#execution) | TTP | -| [Cobalt Strike Named Pipes](/endpoint/cobalt_strike_named_pipes/) | [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Common Ransomware Extensions](/endpoint/common_ransomware_extensions/) | [Data Destruction](/tags/#data-destruction) | [Impact](/tags/#impact) | Hunting | -| [Common Ransomware Notes](/endpoint/common_ransomware_notes/) | [Data Destruction](/tags/#data-destruction) | [Impact](/tags/#impact) | Hunting | -| [Conti Common Exec parameter](/endpoint/conti_common_exec_parameter/) | [User Execution](/tags/#user-execution) | [Execution](/tags/#execution) | TTP | -| [Control Loading from World Writable Directory](/endpoint/control_loading_from_world_writable_directory/) | [Control Panel](/tags/#control-panel) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Correlation by Repository and Risk](/cloud/correlation_by_repository_and_risk/) | [Malicious Image](/tags/#malicious-image) | [Execution](/tags/#execution) | Correlation | -| [Correlation by User and Risk](/cloud/correlation_by_user_and_risk/) | [Malicious Image](/tags/#malicious-image) | [Execution](/tags/#execution) | Correlation | -| [Create Remote Thread In Shell Application](/endpoint/create_remote_thread_in_shell_application/) | [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Create Remote Thread into LSASS](/endpoint/create_remote_thread_into_lsass/) | [LSASS Memory](/tags/#lsass-memory) | [Credential Access](/tags/#credential-access) | TTP | -| [Create Service In Suspicious File Path](/endpoint/create_service_in_suspicious_file_path/) | [Service Execution](/tags/#service-execution) | [Execution](/tags/#execution) | TTP | -| [Create local admin accounts using net exe](/endpoint/create_local_admin_accounts_using_net_exe/) | [Local Account](/tags/#local-account) | [Persistence](/tags/#persistence) | TTP | -| [Create or delete windows shares using net exe](/endpoint/create_or_delete_windows_shares_using_net_exe/) | [Network Share Connection Removal](/tags/#network-share-connection-removal) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Creation of Shadow Copy](/endpoint/creation_of_shadow_copy/) | [NTDS](/tags/#ntds) | [Credential Access](/tags/#credential-access) | TTP | -| [Creation of Shadow Copy with wmic and powershell](/endpoint/creation_of_shadow_copy_with_wmic_and_powershell/) | [NTDS](/tags/#ntds) | [Credential Access](/tags/#credential-access) | TTP | -| [Creation of lsass Dump with Taskmgr](/endpoint/creation_of_lsass_dump_with_taskmgr/) | [LSASS Memory](/tags/#lsass-memory) | [Credential Access](/tags/#credential-access) | TTP | -| [Credential Dumping via Copy Command from Shadow Copy](/endpoint/credential_dumping_via_copy_command_from_shadow_copy/) | [NTDS](/tags/#ntds) | [Credential Access](/tags/#credential-access) | TTP | -| [Credential Dumping via Symlink to Shadow Copy](/endpoint/credential_dumping_via_symlink_to_shadow_copy/) | [NTDS](/tags/#ntds) | [Credential Access](/tags/#credential-access) | TTP | -| [Credential Extraction indicative of FGDump and CacheDump with s option](/endpoint/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) | TTP | -| [Credential Extraction indicative of FGDump and CacheDump with v option](/endpoint/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) | TTP | -| [Credential Extraction indicative of Lazagne command line options](/endpoint/credential_extraction_indicative_of_lazagne_command_line_options/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Credentials from Password Stores](/tags/#credentials-from-password-stores) | [Credential Access](/tags/#credential-access) | TTP | -| [Credential Extraction indicative of use of DSInternals credential conversion modules](/endpoint/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) | TTP | -| [Credential Extraction indicative of use of DSInternals modules](/endpoint/credential_extraction_indicative_of_use_of_dsinternals_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) | TTP | -| [Credential Extraction indicative of use of Mimikatz modules](/endpoint/credential_extraction_indicative_of_use_of_mimikatz_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) | TTP | -| [Credential Extraction indicative of use of PowerSploit modules](/endpoint/credential_extraction_indicative_of_use_of_powersploit_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) | TTP | -| [Credential Extraction native Microsoft debuggers peek into the kernel](/endpoint/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) | TTP | -| [Credential Extraction native Microsoft debuggers via z command line option](/endpoint/credential_extraction_native_microsoft_debuggers_via_z_command_line_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) | TTP | -| [Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals](/endpoint/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) | TTP | -| [DLLHost with no Command Line Arguments with Network](/endpoint/dllhost_with_no_command_line_arguments_with_network/) | [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) | TTP | -| [DNS Query Length Outliers - MLTK](/network/dns_query_length_outliers_-_mltk/) | [DNS](/tags/#dns) | [Command And Control](/tags/#command-and-control) | Anomaly | -| [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | [Exfiltration](/tags/#exfiltration) | Anomaly | -| [DSQuery Domain Discovery](/endpoint/dsquery_domain_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | [Discovery](/tags/#discovery) | TTP | -| [Delete A Net User](/endpoint/delete_a_net_user/) | [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) | Anomaly | -| [Delete ShadowCopy With PowerShell](/endpoint/delete_shadowcopy_with_powershell/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | [Impact](/tags/#impact) | TTP | -| [Deleting Of Net Users](/endpoint/deleting_of_net_users/) | [Account Access Removal](/tags/#account-access-removal) | [Impact](/tags/#impact) | TTP | -| [Deleting Shadow Copies](/endpoint/deleting_shadow_copies/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | [Impact](/tags/#impact) | TTP | -| [Deny Permission using Cacls Utility](/endpoint/deny_permission_using_cacls_utility/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Detect ARP Poisoning](/network/detect_arp_poisoning/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | [Initial Access](/tags/#initial-access) | TTP | -| [Detect AWS Console Login by New User]() | None | None | Hunting | -| [Detect AWS Console Login by User from New City](/cloud/detect_aws_console_login_by_user_from_new_city/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) | Hunting | -| [Detect AWS Console Login by User from New Country](/cloud/detect_aws_console_login_by_user_from_new_country/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) | Hunting | -| [Detect AWS Console Login by User from New Region](/cloud/detect_aws_console_login_by_user_from_new_region/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) | Hunting | -| [Detect Activity Related to Pass the Hash Attacks](/endpoint/detect_activity_related_to_pass_the_hash_attacks/) | [Pass the Hash](/tags/#pass-the-hash) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Detect AzureHound Command-Line Arguments](/endpoint/detect_azurehound_command-line_arguments/) | [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) | TTP | -| [Detect AzureHound File Modifications](/endpoint/detect_azurehound_file_modifications/) | [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) | TTP | -| [Detect Baron Samedit CVE-2021-3156](/endpoint/detect_baron_samedit_cve-2021-3156/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [Detect Baron Samedit CVE-2021-3156 Segfault](/endpoint/detect_baron_samedit_cve-2021-3156_segfault/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [Detect Baron Samedit CVE-2021-3156 via OSQuery](/endpoint/detect_baron_samedit_cve-2021-3156_via_osquery/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [Detect Computer Changed with Anonymous Account](/endpoint/detect_computer_changed_with_anonymous_account/) | [Exploitation of Remote Services](/tags/#exploitation-of-remote-services) | [Lateral Movement](/tags/#lateral-movement) | Hunting | -| [Detect Copy of ShadowCopy with Script Block Logging](/endpoint/detect_copy_of_shadowcopy_with_script_block_logging/) | [Security Account Manager](/tags/#security-account-manager) | [Credential Access](/tags/#credential-access) | TTP | -| [Detect Credential Dumping through LSASS access](/endpoint/detect_credential_dumping_through_lsass_access/) | [LSASS Memory](/tags/#lsass-memory) | [Credential Access](/tags/#credential-access) | TTP | -| [Detect Dump LSASS Memory using comsvcs](/endpoint/detect_dump_lsass_memory_using_comsvcs/) | [NTDS](/tags/#ntds) | [Credential Access](/tags/#credential-access) | TTP | -| [Detect Empire with PowerShell Script Block Logging](/endpoint/detect_empire_with_powershell_script_block_logging/) | [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) | TTP | -| [Detect Excessive Account Lockouts From Endpoint](/endpoint/detect_excessive_account_lockouts_from_endpoint/) | [Domain Accounts](/tags/#domain-accounts) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [Detect Excessive User Account Lockouts](/endpoint/detect_excessive_user_account_lockouts/) | [Local Accounts](/tags/#local-accounts) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [Detect Exchange Web Shell](/endpoint/detect_exchange_web_shell/) | [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) | TTP | -| [Detect F5 TMUI RCE CVE-2020-5902](/web/detect_f5_tmui_rce_cve-2020-5902/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | TTP | -| [Detect GCP Storage access from a new IP](/cloud/detect_gcp_storage_access_from_a_new_ip/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) | Anomaly | -| [Detect HTML Help Renamed](/endpoint/detect_html_help_renamed/) | [Compiled HTML File](/tags/#compiled-html-file) | [Defense Evasion](/tags/#defense-evasion) | Hunting | -| [Detect HTML Help Spawn Child Process](/endpoint/detect_html_help_spawn_child_process/) | [Compiled HTML File](/tags/#compiled-html-file) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Detect HTML Help URL in Command Line](/endpoint/detect_html_help_url_in_command_line/) | [Compiled HTML File](/tags/#compiled-html-file) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Detect HTML Help Using InfoTech Storage Handlers](/endpoint/detect_html_help_using_infotech_storage_handlers/) | [Compiled HTML File](/tags/#compiled-html-file) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Detect IPv6 Network Infrastructure Threats](/network/detect_ipv6_network_infrastructure_threats/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | [Initial Access](/tags/#initial-access) | TTP | -| [Detect Kerberoasting](/endpoint/detect_kerberoasting/) | [Kerberoasting](/tags/#kerberoasting) | [Credential Access](/tags/#credential-access) | TTP | -| [Detect Large Outbound ICMP Packets](/network/detect_large_outbound_icmp_packets/) | [Non-Application Layer Protocol](/tags/#non-application-layer-protocol) | [Command And Control](/tags/#command-and-control) | TTP | -| [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [Mshta](/tags/#mshta) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Detect Mimikatz Using Loaded Images](/endpoint/detect_mimikatz_using_loaded_images/) | [LSASS Memory](/tags/#lsass-memory) | [Credential Access](/tags/#credential-access) | TTP | -| [Detect Mimikatz With PowerShell Script Block Logging](/endpoint/detect_mimikatz_with_powershell_script_block_logging/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) | TTP | -| [Detect New Local Admin account](/endpoint/detect_new_local_admin_account/) | [Local Account](/tags/#local-account) | [Persistence](/tags/#persistence) | TTP | -| [Detect New Login Attempts to Routers]() | None | None | TTP | -| [Detect New Open GCP Storage Buckets](/cloud/detect_new_open_gcp_storage_buckets/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) | TTP | -| [Detect New Open S3 Buckets over AWS CLI](/cloud/detect_new_open_s3_buckets_over_aws_cli/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) | TTP | -| [Detect New Open S3 buckets](/cloud/detect_new_open_s3_buckets/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) | TTP | -| [Detect Outbound SMB Traffic](/network/detect_outbound_smb_traffic/) | [File Transfer Protocols](/tags/#file-transfer-protocols) | [Command And Control](/tags/#command-and-control) | TTP | -| [Detect Outlook exe writing a zip file](/endpoint/detect_outlook_exe_writing_a_zip_file/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | TTP | -| [Detect Pass the Hash](/endpoint/detect_pass_the_hash/) | [Pass the Hash](/tags/#pass-the-hash) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Detect Path Interception By Creation Of program exe](/endpoint/detect_path_interception_by_creation_of_program_exe/) | [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path) | [Persistence](/tags/#persistence) | TTP | -| [Detect Port Security Violation](/network/detect_port_security_violation/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | [Initial Access](/tags/#initial-access) | TTP | -| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Windows Command Shell](/tags/#windows-command-shell) | [Execution](/tags/#execution) | Hunting | -| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Execution](/tags/#execution) | TTP | -| [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) | TTP | -| [Detect RClone Command-Line Usage](/endpoint/detect_rclone_command-line_usage/) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) | TTP | -| [Detect Rare Executables]() | None | None | Anomaly | -| [Detect Regasm Spawning a Process](/endpoint/detect_regasm_spawning_a_process/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Detect Regasm with Network Connection](/endpoint/detect_regasm_with_network_connection/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Detect Regasm with no Command Line Arguments](/endpoint/detect_regasm_with_no_command_line_arguments/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Detect Regsvcs Spawning a Process](/endpoint/detect_regsvcs_spawning_a_process/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Detect Regsvcs with Network Connection](/endpoint/detect_regsvcs_with_network_connection/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Detect Regsvcs with No Command Line Arguments](/endpoint/detect_regsvcs_with_no_command_line_arguments/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Detect Regsvr32 Application Control Bypass](/endpoint/detect_regsvr32_application_control_bypass/) | [Regsvr32](/tags/#regsvr32) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Detect Renamed 7-Zip](/endpoint/detect_renamed_7-zip/) | [Archive via Utility](/tags/#archive-via-utility) | [Collection](/tags/#collection) | Hunting | -| [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [Service Execution](/tags/#service-execution) | [Execution](/tags/#execution) | Hunting | -| [Detect Renamed RClone](/endpoint/detect_renamed_rclone/) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Exfiltration](/tags/#exfiltration) | Hunting | -| [Detect Renamed WinRAR](/endpoint/detect_renamed_winrar/) | [Archive via Utility](/tags/#archive-via-utility) | [Collection](/tags/#collection) | Hunting | -| [Detect Rogue DHCP Server](/network/detect_rogue_dhcp_server/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle) | [Initial Access](/tags/#initial-access) | TTP | -| [Detect Rundll32 Application Control Bypass - advpack](/endpoint/detect_rundll32_application_control_bypass_-_advpack/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Detect Rundll32 Application Control Bypass - setupapi](/endpoint/detect_rundll32_application_control_bypass_-_setupapi/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Detect Rundll32 Application Control Bypass - syssetup](/endpoint/detect_rundll32_application_control_bypass_-_syssetup/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Detect Rundll32 Inline HTA Execution](/endpoint/detect_rundll32_inline_hta_execution/) | [Mshta](/tags/#mshta) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Detect S3 access from a new IP](/cloud/detect_s3_access_from_a_new_ip/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) | Anomaly | -| [Detect SNICat SNI Exfiltration](/network/detect_snicat_sni_exfiltration/) | [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel) | [Exfiltration](/tags/#exfiltration) | TTP | -| [Detect SharpHound Command-Line Arguments](/endpoint/detect_sharphound_command-line_arguments/) | [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) | TTP | -| [Detect SharpHound File Modifications](/endpoint/detect_sharphound_file_modifications/) | [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) | TTP | -| [Detect SharpHound Usage](/endpoint/detect_sharphound_usage/) | [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) | TTP | -| [Detect Software Download To Network Device](/network/detect_software_download_to_network_device/) | [TFTP Boot](/tags/#tftp-boot) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Detect Spike in AWS Security Hub Alerts for EC2 Instance]() | None | None | Anomaly | -| [Detect Spike in AWS Security Hub Alerts for User]() | None | None | Anomaly | -| [Detect Spike in S3 Bucket deletion](/cloud/detect_spike_in_s3_bucket_deletion/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) | Anomaly | -| [Detect Spike in blocked Outbound Traffic from your AWS]() | None | None | Anomaly | -| [Detect Traffic Mirroring](/network/detect_traffic_mirroring/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Traffic Duplication](/tags/#traffic-duplication) | [Initial Access](/tags/#initial-access) | TTP | -| [Detect Unauthorized Assets by MAC address]() | None | None | TTP | -| [Detect Use of cmd exe to Launch Script Interpreters](/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters/) | [Windows Command Shell](/tags/#windows-command-shell) | [Execution](/tags/#execution) | TTP | -| [Detect WMI Event Subscription Persistence](/endpoint/detect_wmi_event_subscription_persistence/) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [Detect Windows DNS SIGRed via Splunk Stream](/network/detect_windows_dns_sigred_via_splunk_stream/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) | TTP | -| [Detect Windows DNS SIGRed via Zeek](/network/detect_windows_dns_sigred_via_zeek/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) | TTP | -| [Detect Zerologon via Zeek](/network/detect_zerologon_via_zeek/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | TTP | -| [Detect attackers scanning for vulnerable JBoss servers](/web/detect_attackers_scanning_for_vulnerable_jboss_servers/) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) | TTP | -| [Detect hosts connecting to dynamic domain providers](/network/detect_hosts_connecting_to_dynamic_domain_providers/) | [Drive-by Compromise](/tags/#drive-by-compromise) | [Initial Access](/tags/#initial-access) | TTP | -| [Detect malicious requests to exploit JBoss servers]() | None | None | TTP | -| [Detect mshta inline hta execution](/endpoint/detect_mshta_inline_hta_execution/) | [Mshta](/tags/#mshta) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Detect mshta renamed](/endpoint/detect_mshta_renamed/) | [Mshta](/tags/#mshta) | [Defense Evasion](/tags/#defense-evasion) | Hunting | -| [Detect processes used for System Network Configuration Discovery](/endpoint/detect_processes_used_for_system_network_configuration_discovery/) | [System Network Configuration Discovery](/tags/#system-network-configuration-discovery) | [Discovery](/tags/#discovery) | TTP | -| [Detect shared ec2 snapshot](/cloud/detect_shared_ec2_snapshot/) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Exfiltration](/tags/#exfiltration) | TTP | -| [Detection of tools built by NirSoft](/endpoint/detection_of_tools_built_by_nirsoft/) | [Software Deployment Tools](/tags/#software-deployment-tools) | [Execution](/tags/#execution) | TTP | -| [Disable AMSI Through Registry](/endpoint/disable_amsi_through_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Disable ETW Through Registry](/endpoint/disable_etw_through_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Disable Logs Using WevtUtil](/endpoint/disable_logs_using_wevtutil/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Disable Net User Account](/endpoint/disable_net_user_account/) | [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) | TTP | -| [Disable Registry Tool](/endpoint/disable_registry_tool/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Disable Show Hidden Files](/endpoint/disable_show_hidden_files/) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Disable Windows App Hotkeys](/endpoint/disable_windows_app_hotkeys/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Disable Windows Behavior Monitoring](/endpoint/disable_windows_behavior_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Disable Windows SmartScreen Protection](/endpoint/disable_windows_smartscreen_protection/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Disabling CMD Application](/endpoint/disabling_cmd_application/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Disabling ControlPanel](/endpoint/disabling_controlpanel/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Disabling Firewall with Netsh](/endpoint/disabling_firewall_with_netsh/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Disabling FolderOptions Windows Feature](/endpoint/disabling_folderoptions_windows_feature/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Disabling Net User Account](/endpoint/disabling_net_user_account/) | [Account Access Removal](/tags/#account-access-removal) | [Impact](/tags/#impact) | TTP | -| [Disabling NoRun Windows App](/endpoint/disabling_norun_windows_app/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [Disabling SystemRestore In Registry](/endpoint/disabling_systemrestore_in_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Disabling Task Manager](/endpoint/disabling_task_manager/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Domain Account Discovery With Net App](/endpoint/domain_account_discovery_with_net_app/) | [Domain Account](/tags/#domain-account) | [Discovery](/tags/#discovery) | TTP | -| [Domain Account Discovery with Dsquery](/endpoint/domain_account_discovery_with_dsquery/) | [Domain Account](/tags/#domain-account) | [Discovery](/tags/#discovery) | Hunting | -| [Domain Account Discovery with Wmic](/endpoint/domain_account_discovery_with_wmic/) | [Domain Account](/tags/#domain-account) | [Discovery](/tags/#discovery) | TTP | -| [Domain Controller Discovery with Nltest](/endpoint/domain_controller_discovery_with_nltest/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | TTP | -| [Domain Controller Discovery with Wmic](/endpoint/domain_controller_discovery_with_wmic/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [Domain Group Discovery With Dsquery](/endpoint/domain_group_discovery_with_dsquery/) | [Domain Groups](/tags/#domain-groups) | [Discovery](/tags/#discovery) | Hunting | -| [Domain Group Discovery With Net](/endpoint/domain_group_discovery_with_net/) | [Domain Groups](/tags/#domain-groups) | [Discovery](/tags/#discovery) | Hunting | -| [Domain Group Discovery With Wmic](/endpoint/domain_group_discovery_with_wmic/) | [Domain Groups](/tags/#domain-groups) | [Discovery](/tags/#discovery) | Hunting | -| [Domain Group Discovery with Adsisearcher](/endpoint/domain_group_discovery_with_adsisearcher/) | [Domain Groups](/tags/#domain-groups) | [Discovery](/tags/#discovery) | TTP | -| [Download Files Using Telegram](/endpoint/download_files_using_telegram/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control) | TTP | -| [Drop IcedID License dat](/endpoint/drop_icedid_license_dat/) | [Malicious File](/tags/#malicious-file) | [Execution](/tags/#execution) | Hunting | -| [Dump LSASS via comsvcs DLL](/endpoint/dump_lsass_via_comsvcs_dll/) | [LSASS Memory](/tags/#lsass-memory) | [Credential Access](/tags/#credential-access) | TTP | -| [Dump LSASS via procdump](/endpoint/dump_lsass_via_procdump/) | [LSASS Memory](/tags/#lsass-memory) | [Credential Access](/tags/#credential-access) | TTP | -| [Elevated Group Discovery With Net](/endpoint/elevated_group_discovery_with_net/) | [Domain Groups](/tags/#domain-groups) | [Discovery](/tags/#discovery) | TTP | -| [Elevated Group Discovery With Wmic](/endpoint/elevated_group_discovery_with_wmic/) | [Domain Groups](/tags/#domain-groups) | [Discovery](/tags/#discovery) | TTP | -| [Elevated Group Discovery with PowerView](/endpoint/elevated_group_discovery_with_powerview/) | [Domain Groups](/tags/#domain-groups) | [Discovery](/tags/#discovery) | Hunting | -| [Email Attachments With Lots Of Spaces]() | None | None | Anomaly | -| [Email files written outside of the Outlook directory](/application/email_files_written_outside_of_the_outlook_directory/) | [Local Email Collection](/tags/#local-email-collection) | [Collection](/tags/#collection) | TTP | -| [Email servers sending high volume traffic to hosts](/application/email_servers_sending_high_volume_traffic_to_hosts/) | [Remote Email Collection](/tags/#remote-email-collection) | [Collection](/tags/#collection) | Anomaly | -| [Enable RDP In Other Port Number](/endpoint/enable_rdp_in_other_port_number/) | [Remote Services](/tags/#remote-services) | [Lateral Movement](/tags/#lateral-movement) | TTP | -| [Enumerate Users Local Group Using Telegram](/endpoint/enumerate_users_local_group_using_telegram/) | [Account Discovery](/tags/#account-discovery) | [Discovery](/tags/#discovery) | TTP | -| [Esentutl SAM Copy](/endpoint/esentutl_sam_copy/) | [Security Account Manager](/tags/#security-account-manager) | [Credential Access](/tags/#credential-access) | Hunting | -| [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [Excel Spawning PowerShell](/endpoint/excel_spawning_powershell/) | [Security Account Manager](/tags/#security-account-manager) | [Credential Access](/tags/#credential-access) | TTP | -| [Excel Spawning Windows Script Host](/endpoint/excel_spawning_windows_script_host/) | [Security Account Manager](/tags/#security-account-manager) | [Credential Access](/tags/#credential-access) | TTP | -| [Excessive Attempt To Disable Services](/endpoint/excessive_attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) | Anomaly | -| [Excessive DNS Failures](/network/excessive_dns_failures/) | [DNS](/tags/#dns) | [Command And Control](/tags/#command-and-control) | Anomaly | -| [Excessive Service Stop Attempt](/endpoint/excessive_service_stop_attempt/) | [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) | Anomaly | -| [Excessive Usage Of Cacls App](/endpoint/excessive_usage_of_cacls_app/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [Excessive Usage Of Net App](/endpoint/excessive_usage_of_net_app/) | [Account Access Removal](/tags/#account-access-removal) | [Impact](/tags/#impact) | Anomaly | -| [Excessive Usage Of SC Service Utility](/endpoint/excessive_usage_of_sc_service_utility/) | [Service Execution](/tags/#service-execution) | [Execution](/tags/#execution) | Anomaly | -| [Excessive Usage Of Taskkill](/endpoint/excessive_usage_of_taskkill/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [Excessive Usage of NSLOOKUP App](/endpoint/excessive_usage_of_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) | Anomaly | -| [Excessive number of distinct processes created in Windows Temp folder](/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Execution](/tags/#execution) | Anomaly | -| [Excessive number of service control start as disabled](/endpoint/excessive_number_of_service_control_start_as_disabled/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [Excessive number of taskhost processes](/endpoint/excessive_number_of_taskhost_processes/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) | Anomaly | -| [Exchange PowerShell Abuse via SSRF](/endpoint/exchange_powershell_abuse_via_ssrf/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | TTP | -| [Exchange PowerShell Module Usage](/endpoint/exchange_powershell_module_usage/) | [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) | TTP | -| [Executables Or Script Creation In Suspicious Path](/endpoint/executables_or_script_creation_in_suspicious_path/) | [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Execute Javascript With Jscript COM CLSID](/endpoint/execute_javascript_with_jscript_com_clsid/) | [Visual Basic](/tags/#visual-basic) | [Execution](/tags/#execution) | TTP | -| [Execution of File with Multiple Extensions](/endpoint/execution_of_file_with_multiple_extensions/) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Extraction of Registry Hives](/endpoint/extraction_of_registry_hives/) | [Security Account Manager](/tags/#security-account-manager) | [Credential Access](/tags/#credential-access) | TTP | -| [File with Samsam Extension]() | None | None | TTP | -| [First Time Seen Child Process of Zoom](/endpoint/first_time_seen_child_process_of_zoom/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) | Anomaly | -| [First Time Seen Running Windows Service](/endpoint/first_time_seen_running_windows_service/) | [Service Execution](/tags/#service-execution) | [Execution](/tags/#execution) | Anomaly | -| [First time seen command line argument](/endpoint/first_time_seen_command_line_argument/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution) | [Execution](/tags/#execution) | Anomaly | -| [FodHelper UAC Bypass](/endpoint/fodhelper_uac_bypass/) | [Modify Registry](/tags/#modify-registry), [Bypass User Account Control](/tags/#bypass-user-account-control) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Fsutil Zeroing File](/endpoint/fsutil_zeroing_file/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [GCP Detect gcploit framework](/cloud/gcp_detect_gcploit_framework/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [GCP Kubernetes cluster pod scan detection](/cloud/gcp_kubernetes_cluster_pod_scan_detection/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [GPUpdate with no Command Line Arguments with Network](/endpoint/gpupdate_with_no_command_line_arguments_with_network/) | [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [GSuite Email Suspicious Attachment](/cloud/gsuite_email_suspicious_attachment/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | Anomaly | -| [Get ADDefaultDomainPasswordPolicy with Powershell](/endpoint/get_addefaultdomainpasswordpolicy_with_powershell/) | [Password Policy Discovery](/tags/#password-policy-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [Get ADDefaultDomainPasswordPolicy with Powershell Script Block](/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block/) | [Password Policy Discovery](/tags/#password-policy-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [Get ADUser with PowerShell](/endpoint/get_aduser_with_powershell/) | [Domain Account](/tags/#domain-account) | [Discovery](/tags/#discovery) | Hunting | -| [Get ADUser with PowerShell Script Block](/endpoint/get_aduser_with_powershell_script_block/) | [Domain Account](/tags/#domain-account) | [Discovery](/tags/#discovery) | Hunting | -| [Get ADUserResultantPasswordPolicy with Powershell](/endpoint/get_aduserresultantpasswordpolicy_with_powershell/) | [Password Policy Discovery](/tags/#password-policy-discovery) | [Discovery](/tags/#discovery) | TTP | -| [Get ADUserResultantPasswordPolicy with Powershell Script Block](/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block/) | [Password Policy Discovery](/tags/#password-policy-discovery) | [Discovery](/tags/#discovery) | TTP | -| [Get DomainPolicy with Powershell](/endpoint/get_domainpolicy_with_powershell/) | [Password Policy Discovery](/tags/#password-policy-discovery) | [Discovery](/tags/#discovery) | TTP | -| [Get DomainPolicy with Powershell Script Block](/endpoint/get_domainpolicy_with_powershell_script_block/) | [Password Policy Discovery](/tags/#password-policy-discovery) | [Discovery](/tags/#discovery) | TTP | -| [Get DomainUser with PowerShell](/endpoint/get_domainuser_with_powershell/) | [Domain Account](/tags/#domain-account) | [Discovery](/tags/#discovery) | TTP | -| [Get DomainUser with PowerShell Script Block](/endpoint/get_domainuser_with_powershell_script_block/) | [Domain Account](/tags/#domain-account) | [Discovery](/tags/#discovery) | TTP | -| [Get WMIObject Group Discovery](/endpoint/get_wmiobject_group_discovery/) | [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) | Hunting | -| [Get WMIObject Group Discovery with Script Block Logging](/endpoint/get_wmiobject_group_discovery_with_script_block_logging/) | [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) | Hunting | -| [Get-DomainTrust with PowerShell](/endpoint/get-domaintrust_with_powershell/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | [Discovery](/tags/#discovery) | TTP | -| [Get-DomainTrust with PowerShell Script Block](/endpoint/get-domaintrust_with_powershell_script_block/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | [Discovery](/tags/#discovery) | TTP | -| [Get-ForestTrust with PowerShell](/endpoint/get-foresttrust_with_powershell/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | [Discovery](/tags/#discovery) | TTP | -| [Get-ForestTrust with PowerShell Script Block](/endpoint/get-foresttrust_with_powershell_script_block/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | [Discovery](/tags/#discovery) | TTP | -| [GetAdComputer with PowerShell](/endpoint/getadcomputer_with_powershell/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [GetAdComputer with PowerShell Script Block](/endpoint/getadcomputer_with_powershell_script_block/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [GetAdGroup with PowerShell](/endpoint/getadgroup_with_powershell/) | [Domain Groups](/tags/#domain-groups) | [Discovery](/tags/#discovery) | Hunting | -| [GetAdGroup with PowerShell Script Block](/endpoint/getadgroup_with_powershell_script_block/) | [Domain Groups](/tags/#domain-groups) | [Discovery](/tags/#discovery) | Hunting | -| [GetCurrent User with PowerShell](/endpoint/getcurrent_user_with_powershell/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [GetCurrent User with PowerShell Script Block](/endpoint/getcurrent_user_with_powershell_script_block/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [GetDomainComputer with PowerShell](/endpoint/getdomaincomputer_with_powershell/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | TTP | -| [GetDomainComputer with PowerShell Script Block](/endpoint/getdomaincomputer_with_powershell_script_block/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | TTP | -| [GetDomainController with PowerShell](/endpoint/getdomaincontroller_with_powershell/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [GetDomainController with PowerShell Script Block](/endpoint/getdomaincontroller_with_powershell_script_block/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | TTP | -| [GetDomainGroup with PowerShell](/endpoint/getdomaingroup_with_powershell/) | [Domain Groups](/tags/#domain-groups) | [Discovery](/tags/#discovery) | TTP | -| [GetDomainGroup with PowerShell Script Block](/endpoint/getdomaingroup_with_powershell_script_block/) | [Domain Groups](/tags/#domain-groups) | [Discovery](/tags/#discovery) | TTP | -| [GetLocalUser with PowerShell](/endpoint/getlocaluser_with_powershell/) | [Local Account](/tags/#local-account) | [Discovery](/tags/#discovery) | Hunting | -| [GetLocalUser with PowerShell Script Block](/endpoint/getlocaluser_with_powershell_script_block/) | [Local Account](/tags/#local-account) | [Discovery](/tags/#discovery) | Hunting | -| [GetNetTcpconnection with PowerShell](/endpoint/getnettcpconnection_with_powershell/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [GetNetTcpconnection with PowerShell Script Block](/endpoint/getnettcpconnection_with_powershell_script_block/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [GetWmiObject DS User with PowerShell](/endpoint/getwmiobject_ds_user_with_powershell/) | [Domain Account](/tags/#domain-account) | [Discovery](/tags/#discovery) | TTP | -| [GetWmiObject DS User with PowerShell Script Block](/endpoint/getwmiobject_ds_user_with_powershell_script_block/) | [Domain Account](/tags/#domain-account) | [Discovery](/tags/#discovery) | TTP | -| [GetWmiObject Ds Computer with PowerShell](/endpoint/getwmiobject_ds_computer_with_powershell/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | TTP | -| [GetWmiObject Ds Computer with PowerShell Script Block](/endpoint/getwmiobject_ds_computer_with_powershell_script_block/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | TTP | -| [GetWmiObject Ds Group with PowerShell](/endpoint/getwmiobject_ds_group_with_powershell/) | [Domain Groups](/tags/#domain-groups) | [Discovery](/tags/#discovery) | TTP | -| [GetWmiObject Ds Group with PowerShell Script Block](/endpoint/getwmiobject_ds_group_with_powershell_script_block/) | [Domain Groups](/tags/#domain-groups) | [Discovery](/tags/#discovery) | TTP | -| [GetWmiObject User Account with PowerShell](/endpoint/getwmiobject_user_account_with_powershell/) | [Local Account](/tags/#local-account) | [Discovery](/tags/#discovery) | Hunting | -| [GetWmiObject User Account with PowerShell Script Block](/endpoint/getwmiobject_user_account_with_powershell_script_block/) | [Local Account](/tags/#local-account) | [Discovery](/tags/#discovery) | Hunting | -| [GitHub Dependabot Alert](/cloud/github_dependabot_alert/) | [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools) | [Initial Access](/tags/#initial-access) | Anomaly | -| [GitHub Pull Request from Unknown User](/cloud/github_pull_request_from_unknown_user/) | [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools) | [Initial Access](/tags/#initial-access) | Anomaly | -| [Github Commit Changes In Master](/cloud/github_commit_changes_in_master/) | [Trusted Relationship](/tags/#trusted-relationship) | [Initial Access](/tags/#initial-access) | Anomaly | -| [Github Commit In Develop](/cloud/github_commit_in_develop/) | [Trusted Relationship](/tags/#trusted-relationship) | [Initial Access](/tags/#initial-access) | Anomaly | -| [Grant Permission Using Cacls Utility](/endpoint/grant_permission_using_cacls_utility/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Gsuite Drive Share In External Email](/cloud/gsuite_drive_share_in_external_email/) | [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage) | [Exfiltration](/tags/#exfiltration) | Anomaly | -| [Gsuite Email Suspicious Subject With Attachment](/cloud/gsuite_email_suspicious_subject_with_attachment/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | Anomaly | -| [Gsuite Email With Known Abuse Web Service Link](/cloud/gsuite_email_with_known_abuse_web_service_link/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | Anomaly | -| [Gsuite Outbound Email With Attachment To External Domain](/cloud/gsuite_outbound_email_with_attachment_to_external_domain/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | [Exfiltration](/tags/#exfiltration) | Anomaly | -| [Gsuite Suspicious Shared File Name](/cloud/gsuite_suspicious_shared_file_name/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | Anomaly | -| [Hide User Account From Sign-In Screen](/endpoint/hide_user_account_from_sign-in_screen/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [High File Deletion Frequency](/endpoint/high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | [Impact](/tags/#impact) | Anomaly | -| [High Number of Login Failures from a single source](/cloud/high_number_of_login_failures_from_a_single_source/) | [Password Guessing](/tags/#password-guessing) | [Credential Access](/tags/#credential-access) | Anomaly | -| [High Process Termination Frequency](/endpoint/high_process_termination_frequency/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) | Anomaly | -| [Hosts receiving high volume of network traffic from email server](/network/hosts_receiving_high_volume_of_network_traffic_from_email_server/) | [Remote Email Collection](/tags/#remote-email-collection) | [Collection](/tags/#collection) | Anomaly | -| [ICACLS Grant Command](/endpoint/icacls_grant_command/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Icacls Deny Command](/endpoint/icacls_deny_command/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [IcedID Exfiltrated Archived File Creation](/endpoint/icedid_exfiltrated_archived_file_creation/) | [Archive via Utility](/tags/#archive-via-utility) | [Collection](/tags/#collection) | Hunting | -| [Illegal Access To User Content via PowerSploit modules](/endpoint/illegal_access_to_user_content_via_powersploit_modules/) | [Remote Services](/tags/#remote-services), [Screen Capture](/tags/#screen-capture), [Audio Capture](/tags/#audio-capture), [Remote Service Session Hijacking](/tags/#remote-service-session-hijacking) | [Lateral Movement](/tags/#lateral-movement) | TTP | -| [Illegal Account Creation via PowerSploit modules](/endpoint/illegal_account_creation_via_powersploit_modules/) | [Establish Accounts](/tags/#establish-accounts) | [Resource Development](/tags/#resource-development) | TTP | -| [Illegal Deletion of Logs via Mimikatz modules](/endpoint/illegal_deletion_of_logs_via_mimikatz_modules/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Illegal Enabling or Disabling of Accounts via DSInternals modules](/endpoint/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Illegal Management of Active Directory Elements and Policies via DSInternals modules](/endpoint/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules/) | [Account Manipulation](/tags/#account-manipulation), [Rogue Domain Controller](/tags/#rogue-domain-controller), [Domain Policy Modification](/tags/#domain-policy-modification) | [Persistence](/tags/#persistence) | TTP | -| [Illegal Management of Computers and Active Directory Elements via PowerSploit modules](/endpoint/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules/) | [Account Manipulation](/tags/#account-manipulation), [Rogue Domain Controller](/tags/#rogue-domain-controller), [Domain Policy Modification](/tags/#domain-policy-modification) | [Persistence](/tags/#persistence) | TTP | -| [Illegal Privilege Elevation and Persistence via PowerSploit modules](/endpoint/illegal_privilege_elevation_and_persistence_via_powersploit_modules/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Execution](/tags/#execution) | TTP | -| [Illegal Privilege Elevation via Mimikatz modules](/endpoint/illegal_privilege_elevation_via_mimikatz_modules/) | [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Illegal Service and Process Control via Mimikatz modules](/endpoint/illegal_service_and_process_control_via_mimikatz_modules/) | [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Illegal Service and Process Control via PowerSploit modules](/endpoint/illegal_service_and_process_control_via_powersploit_modules/) | [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Jscript Execution Using Cscript App](/endpoint/jscript_execution_using_cscript_app/) | [JavaScript](/tags/#javascript) | [Execution](/tags/#execution) | TTP | -| [Kerberoasting spn request with RC4 encryption](/endpoint/kerberoasting_spn_request_with_rc4_encryption/) | [Kerberoasting](/tags/#kerberoasting) | [Credential Access](/tags/#credential-access) | TTP | -| [Known Services Killed by Ransomware](/endpoint/known_services_killed_by_ransomware/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | [Impact](/tags/#impact) | TTP | -| [Kubernetes AWS detect suspicious kubectl calls]() | None | None | Hunting | -| [Kubernetes Nginx Ingress LFI](/cloud/kubernetes_nginx_ingress_lfi/) | [Exploitation for Credential Access](/tags/#exploitation-for-credential-access) | [Credential Access](/tags/#credential-access) | TTP | -| [Kubernetes Nginx Ingress RFI](/cloud/kubernetes_nginx_ingress_rfi/) | [Exploitation for Credential Access](/tags/#exploitation-for-credential-access) | [Credential Access](/tags/#credential-access) | TTP | -| [Kubernetes Scanner Image Pulling](/cloud/kubernetes_scanner_image_pulling/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) | TTP | -| [Large Volume of DNS ANY Queries](/network/large_volume_of_dns_any_queries/) | [Reflection Amplification](/tags/#reflection-amplification) | [Impact](/tags/#impact) | Anomaly | -| [Local Account Discovery With Wmic](/endpoint/local_account_discovery_with_wmic/) | [Local Account](/tags/#local-account) | [Discovery](/tags/#discovery) | Hunting | -| [Local Account Discovery with Net](/endpoint/local_account_discovery_with_net/) | [Local Account](/tags/#local-account) | [Discovery](/tags/#discovery) | Hunting | -| [MS Scripting Process Loading Ldap Module](/endpoint/ms_scripting_process_loading_ldap_module/) | [JavaScript](/tags/#javascript) | [Execution](/tags/#execution) | Anomaly | -| [MS Scripting Process Loading WMI Module](/endpoint/ms_scripting_process_loading_wmi_module/) | [JavaScript](/tags/#javascript) | [Execution](/tags/#execution) | Anomaly | -| [MSHTML Module Load in Office Product](/endpoint/mshtml_module_load_in_office_product/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | TTP | -| [MacOS - Re-opened Applications]() | None | None | TTP | -| [Mailsniper Invoke functions](/endpoint/mailsniper_invoke_functions/) | [Local Email Collection](/tags/#local-email-collection) | [Collection](/tags/#collection) | TTP | -| [Malicious PowerShell Process - Connect To Internet With Hidden Window](/endpoint/malicious_powershell_process_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) | TTP | -| [Malicious PowerShell Process - Encoded Command](/endpoint/malicious_powershell_process_-_encoded_command/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information) | [Defense Evasion](/tags/#defense-evasion) | Hunting | -| [Malicious PowerShell Process - Execution Policy Bypass](/endpoint/malicious_powershell_process_-_execution_policy_bypass/) | [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) | TTP | -| [Malicious PowerShell Process With Obfuscation Techniques](/endpoint/malicious_powershell_process_with_obfuscation_techniques/) | [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) | TTP | -| [Malicious Powershell Executed As A Service](/endpoint/malicious_powershell_executed_as_a_service/) | [Service Execution](/tags/#service-execution) | [Execution](/tags/#execution) | TTP | -| [Modification Of Wallpaper](/endpoint/modification_of_wallpaper/) | [Defacement](/tags/#defacement) | [Impact](/tags/#impact) | TTP | -| [Modify ACL permission To Files Or Folder](/endpoint/modify_acl_permission_to_files_or_folder/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Modify ACLs Permission Of Files Or Folders](/endpoint/modify_acls_permission_of_files_or_folders/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [Monitor Email For Brand Abuse]() | None | None | TTP | -| [Monitor Registry Keys for Print Monitors](/endpoint/monitor_registry_keys_for_print_monitors/) | [Port Monitors](/tags/#port-monitors) | [Persistence](/tags/#persistence) | TTP | -| [Monitor Web Traffic For Brand Abuse]() | None | None | TTP | -| [More than usual number of LOLBAS applications in short time period](/endpoint/more_than_usual_number_of_lolbas_applications_in_short_time_period/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) | Anomaly | -| [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [Mshta](/tags/#mshta) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Msmpeng Application DLL Side Loading](/endpoint/msmpeng_application_dll_side_loading/) | [DLL Side-Loading](/tags/#dll-side-loading) | [Persistence](/tags/#persistence) | TTP | -| [Multiple Archive Files Http Post Traffic](/network/multiple_archive_files_http_post_traffic/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | [Exfiltration](/tags/#exfiltration) | TTP | -| [Multiple Disabled Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying) | [Credential Access](/tags/#credential-access) | Anomaly | -| [Multiple Invalid Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying) | [Credential Access](/tags/#credential-access) | Anomaly | -| [Multiple Invalid Users Failing To Authenticate From Host Using NTLM](/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm/) | [Password Spraying](/tags/#password-spraying) | [Credential Access](/tags/#credential-access) | Anomaly | -| [Multiple Okta Users With Invalid Credentials From The Same IP](/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip/) | [Default Accounts](/tags/#default-accounts) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Multiple Users Attempting To Authenticate Using Explicit Credentials](/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials/) | [Password Spraying](/tags/#password-spraying) | [Credential Access](/tags/#credential-access) | Anomaly | -| [Multiple Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying) | [Credential Access](/tags/#credential-access) | Anomaly | -| [Multiple Users Failing To Authenticate From Host Using NTLM](/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm/) | [Password Spraying](/tags/#password-spraying) | [Credential Access](/tags/#credential-access) | Anomaly | -| [Multiple Users Failing To Authenticate From Process](/endpoint/multiple_users_failing_to_authenticate_from_process/) | [Password Spraying](/tags/#password-spraying) | [Credential Access](/tags/#credential-access) | Anomaly | -| [Multiple Users Remotely Failing To Authenticate From Host](/endpoint/multiple_users_remotely_failing_to_authenticate_from_host/) | [Password Spraying](/tags/#password-spraying) | [Credential Access](/tags/#credential-access) | Anomaly | -| [NET Profiler UAC bypass](/endpoint/net_profiler_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [NLTest Domain Trust Discovery](/endpoint/nltest_domain_trust_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | [Discovery](/tags/#discovery) | TTP | -| [Net Localgroup Discovery](/endpoint/net_localgroup_discovery/) | [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) | Hunting | -| [Network Connection Discovery With Arp](/endpoint/network_connection_discovery_with_arp/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [Network Connection Discovery With Net](/endpoint/network_connection_discovery_with_net/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [Network Connection Discovery With Netstat](/endpoint/network_connection_discovery_with_netstat/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [New container uploaded to AWS ECR](/cloud/new_container_uploaded_to_aws_ecr/) | [Implant Internal Image](/tags/#implant-internal-image) | [Persistence](/tags/#persistence) | Hunting | -| [Nishang PowershellTCPOneLine](/endpoint/nishang_powershelltcponeline/) | [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) | TTP | -| [No Windows Updates in a time frame]() | None | None | Hunting | -| [Non Chrome Process Accessing Chrome Default Dir](/endpoint/non_chrome_process_accessing_chrome_default_dir/) | [Credentials from Web Browsers](/tags/#credentials-from-web-browsers) | [Credential Access](/tags/#credential-access) | Anomaly | -| [Non Firefox Process Access Firefox Profile Dir](/endpoint/non_firefox_process_access_firefox_profile_dir/) | [Credentials from Web Browsers](/tags/#credentials-from-web-browsers) | [Credential Access](/tags/#credential-access) | Anomaly | -| [Ntdsutil Export NTDS](/endpoint/ntdsutil_export_ntds/) | [NTDS](/tags/#ntds) | [Credential Access](/tags/#credential-access) | TTP | -| [O365 Add App Role Assignment Grant User](/cloud/o365_add_app_role_assignment_grant_user/) | [Cloud Account](/tags/#cloud-account) | [Persistence](/tags/#persistence) | TTP | -| [O365 Added Service Principal](/cloud/o365_added_service_principal/) | [Cloud Account](/tags/#cloud-account) | [Persistence](/tags/#persistence) | TTP | -| [O365 Bypass MFA via Trusted IP](/cloud/o365_bypass_mfa_via_trusted_ip/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [O365 Disable MFA](/cloud/o365_disable_mfa/) | [Modify Authentication Process](/tags/#modify-authentication-process) | [Credential Access](/tags/#credential-access) | TTP | -| [O365 Excessive Authentication Failures Alert](/cloud/o365_excessive_authentication_failures_alert/) | [Brute Force](/tags/#brute-force) | [Credential Access](/tags/#credential-access) | Anomaly | -| [O365 Excessive SSO logon errors](/cloud/o365_excessive_sso_logon_errors/) | [Modify Authentication Process](/tags/#modify-authentication-process) | [Credential Access](/tags/#credential-access) | Anomaly | -| [O365 New Federated Domain Added](/cloud/o365_new_federated_domain_added/) | [Cloud Account](/tags/#cloud-account) | [Persistence](/tags/#persistence) | TTP | -| [O365 PST export alert](/cloud/o365_pst_export_alert/) | [Email Collection](/tags/#email-collection) | [Collection](/tags/#collection) | TTP | -| [O365 Suspicious Admin Email Forwarding](/cloud/o365_suspicious_admin_email_forwarding/) | [Email Forwarding Rule](/tags/#email-forwarding-rule) | [Collection](/tags/#collection) | Anomaly | -| [O365 Suspicious Rights Delegation](/cloud/o365_suspicious_rights_delegation/) | [Remote Email Collection](/tags/#remote-email-collection) | [Collection](/tags/#collection) | TTP | -| [O365 Suspicious User Email Forwarding](/cloud/o365_suspicious_user_email_forwarding/) | [Email Forwarding Rule](/tags/#email-forwarding-rule) | [Collection](/tags/#collection) | Anomaly | -| [Office Application Drop Executable](/endpoint/office_application_drop_executable/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | TTP | -| [Office Application Spawn Regsvr32 process](/endpoint/office_application_spawn_regsvr32_process/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | TTP | -| [Office Application Spawn rundll32 process](/endpoint/office_application_spawn_rundll32_process/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | TTP | -| [Office Document Creating Schedule Task](/endpoint/office_document_creating_schedule_task/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | TTP | -| [Office Document Executing Macro Code](/endpoint/office_document_executing_macro_code/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | TTP | -| [Office Document Spawned Child Process To Download](/endpoint/office_document_spawned_child_process_to_download/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | TTP | -| [Office Product Spawn CMD Process](/endpoint/office_product_spawn_cmd_process/) | [Mshta](/tags/#mshta) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Office Product Spawning BITSAdmin](/endpoint/office_product_spawning_bitsadmin/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | TTP | -| [Office Product Spawning CertUtil](/endpoint/office_product_spawning_certutil/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | TTP | -| [Office Product Spawning MSHTA](/endpoint/office_product_spawning_mshta/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | TTP | -| [Office Product Spawning Rundll32 with no DLL](/endpoint/office_product_spawning_rundll32_with_no_dll/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | TTP | -| [Office Product Spawning Wmic](/endpoint/office_product_spawning_wmic/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | TTP | -| [Office Product Writing cab or inf](/endpoint/office_product_writing_cab_or_inf/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | TTP | -| [Office Spawning Control](/endpoint/office_spawning_control/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | TTP | -| [Okta Account Lockout Events](/application/okta_account_lockout_events/) | [Default Accounts](/tags/#default-accounts) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [Okta Failed SSO Attempts](/application/okta_failed_sso_attempts/) | [Default Accounts](/tags/#default-accounts) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [Okta User Logins From Multiple Cities](/application/okta_user_logins_from_multiple_cities/) | [Default Accounts](/tags/#default-accounts) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [Overwriting Accessibility Binaries](/endpoint/overwriting_accessibility_binaries/) | [Accessibility Features](/tags/#accessibility-features) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [Password Policy Discovery with Net](/endpoint/password_policy_discovery_with_net/) | [Password Policy Discovery](/tags/#password-policy-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [Permission Modification using Takeown App](/endpoint/permission_modification_using_takeown_app/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [PetitPotam Network Share Access Request](/endpoint/petitpotam_network_share_access_request/) | [Forced Authentication](/tags/#forced-authentication) | [Credential Access](/tags/#credential-access) | TTP | -| [PetitPotam Suspicious Kerberos TGT Request](/endpoint/petitpotam_suspicious_kerberos_tgt_request/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) | TTP | -| [Phishing Email Detection by Machine Learning Method - SSA](/application/phishing_email_detection_by_machine_learning_method_-_ssa/) | [Phishing](/tags/#phishing) | [Initial Access](/tags/#initial-access) | Anomaly | -| [Plain HTTP POST Exfiltrated Data](/network/plain_http_post_exfiltrated_data/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | [Exfiltration](/tags/#exfiltration) | TTP | -| [Potential Pass the Token or Hash Observed at the Destination Device](/endpoint/potential_pass_the_token_or_hash_observed_at_the_destination_device/) | [Pass the Hash](/tags/#pass-the-hash) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Potential Pass the Token or Hash Observed by an Event Collecting Device](/endpoint/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device/) | [Pass the Hash](/tags/#pass-the-hash) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [PowerShell 4104 Hunting](/endpoint/powershell_4104_hunting/) | [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) | Hunting | -| [PowerShell Domain Enumeration](/endpoint/powershell_domain_enumeration/) | [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) | TTP | -| [PowerShell Get LocalGroup Discovery](/endpoint/powershell_get_localgroup_discovery/) | [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) | Hunting | -| [PowerShell Loading DotNET into Memory via System Reflection Assembly](/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly/) | [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) | TTP | -| [PowerShell Start-BitsTransfer](/endpoint/powershell_start-bitstransfer/) | [BITS Jobs](/tags/#bits-jobs) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Powershell Creating Thread Mutex](/endpoint/powershell_creating_thread_mutex/) | [Indicator Removal from Tools](/tags/#indicator-removal-from-tools) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Powershell Disable Security Monitoring](/endpoint/powershell_disable_security_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Powershell Enable SMB1Protocol Feature](/endpoint/powershell_enable_smb1protocol_feature/) | [Indicator Removal from Tools](/tags/#indicator-removal-from-tools) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [Powershell Fileless Process Injection via GetProcAddress](/endpoint/powershell_fileless_process_injection_via_getprocaddress/) | [Process Injection](/tags/#process-injection), [PowerShell](/tags/#powershell) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Powershell Fileless Script Contains Base64 Encoded Content](/endpoint/powershell_fileless_script_contains_base64_encoded_content/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [PowerShell](/tags/#powershell) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Powershell Get LocalGroup Discovery with Script Block Logging](/endpoint/powershell_get_localgroup_discovery_with_script_block_logging/) | [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) | Hunting | -| [Powershell Processing Stream Of Data](/endpoint/powershell_processing_stream_of_data/) | [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) | TTP | -| [Powershell Remote Thread To Known Windows Process](/endpoint/powershell_remote_thread_to_known_windows_process/) | [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Powershell Using memory As Backing Store](/endpoint/powershell_using_memory_as_backing_store/) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Prevent Automatic Repair Mode using Bcdedit](/endpoint/prevent_automatic_repair_mode_using_bcdedit/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | [Impact](/tags/#impact) | TTP | -| [Print Spooler Adding A Printer Driver](/endpoint/print_spooler_adding_a_printer_driver/) | [Print Processors](/tags/#print-processors) | [Persistence](/tags/#persistence) | TTP | -| [Print Spooler Failed to Load a Plug-in](/endpoint/print_spooler_failed_to_load_a_plug-in/) | [Print Processors](/tags/#print-processors) | [Persistence](/tags/#persistence) | TTP | -| [Probing Access with Stolen Credentials via PowerSploit modules](/endpoint/probing_access_with_stolen_credentials_via_powersploit_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Process Creating LNK file in Suspicious Location](/endpoint/process_creating_lnk_file_in_suspicious_location/) | [Spearphishing Link](/tags/#spearphishing-link) | [Initial Access](/tags/#initial-access) | TTP | -| [Process Deleting Its Process File Path](/endpoint/process_deleting_its_process_file_path/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Process Execution via WMI](/endpoint/process_execution_via_wmi/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [Execution](/tags/#execution) | TTP | -| [Process Kill Base On File Path](/endpoint/process_kill_base_on_file_path/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Processes Tapping Keyboard Events]() | None | None | TTP | -| [Processes launching netsh](/endpoint/processes_launching_netsh/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Prohibited Network Traffic Allowed](/network/prohibited_network_traffic_allowed/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) | TTP | -| [Protocol or Port Mismatch](/network/protocol_or_port_mismatch/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | [Exfiltration](/tags/#exfiltration) | Anomaly | -| [Protocols passing authentication in cleartext]() | None | None | TTP | -| [Ransomware Notes bulk creation](/endpoint/ransomware_notes_bulk_creation/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) | Anomaly | -| [Rare Parent-Child Process Relationship](/endpoint/rare_parent-child_process_relationship/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Scheduled Task/Job](/tags/#scheduled-task/job), [Software Deployment Tools](/tags/#software-deployment-tools) | [Execution](/tags/#execution) | Anomaly | -| [Recon AVProduct Through Pwh or WMI](/endpoint/recon_avproduct_through_pwh_or_wmi/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | [Reconnaissance](/tags/#reconnaissance) | TTP | -| [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | [Reconnaissance](/tags/#reconnaissance) | TTP | -| [Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules](/endpoint/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Discovery](/tags/#account-discovery), [Domain Policy Modification](/tags/#domain-policy-modification) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Reconnaissance and Access to Accounts and Groups via Mimikatz modules](/endpoint/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Discovery](/tags/#account-discovery), [Domain Policy Modification](/tags/#domain-policy-modification) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit modules](/endpoint/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules/) | [Trusted Relationship](/tags/#trusted-relationship), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Gather Victim Org Information](/tags/#gather-victim-org-information), [Active Scanning](/tags/#active-scanning) | [Initial Access](/tags/#initial-access) | TTP | -| [Reconnaissance and Access to Computers and Domains via PowerSploit modules](/endpoint/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules/) | [Gather Victim Host Information](/tags/#gather-victim-host-information), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Account Discovery](/tags/#account-discovery) | [Reconnaissance](/tags/#reconnaissance) | TTP | -| [Reconnaissance and Access to Computers via Mimikatz modules](/endpoint/reconnaissance_and_access_to_computers_via_mimikatz_modules/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | [Reconnaissance](/tags/#reconnaissance) | TTP | -| [Reconnaissance and Access to Operating System Elements via PowerSploit modules](/endpoint/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules/) | [System Service Discovery](/tags/#system-service-discovery), [Query Registry](/tags/#query-registry), [Network Service Scanning](/tags/#network-service-scanning), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Discovery](/tags/#process-discovery), [File and Directory Discovery](/tags/#file-and-directory-discovery), [Software Discovery](/tags/#software-discovery), [Software](/tags/#software) | [Discovery](/tags/#discovery) | TTP | -| [Reconnaissance and Access to Processes and Services via Mimikatz modules](/endpoint/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules/) | [System Service Discovery](/tags/#system-service-discovery), [Network Service Scanning](/tags/#network-service-scanning), [Process Discovery](/tags/#process-discovery) | [Discovery](/tags/#discovery) | TTP | -| [Reconnaissance and Access to Shared Resources via Mimikatz modules](/endpoint/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Network Share Discovery](/tags/#network-share-discovery), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive) | [Lateral Movement](/tags/#lateral-movement) | TTP | -| [Reconnaissance and Access to Shared Resources via PowerSploit modules](/endpoint/reconnaissance_and_access_to_shared_resources_via_powersploit_modules/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Network Share Discovery](/tags/#network-share-discovery), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive) | [Lateral Movement](/tags/#lateral-movement) | TTP | -| [Reconnaissance of Access and Persistence Opportunities via PowerSploit modules](/endpoint/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Hijack Execution Flow](/tags/#hijack-execution-flow) | [Execution](/tags/#execution) | TTP | -| [Reconnaissance of Connectivity via PowerSploit modules](/endpoint/reconnaissance_of_connectivity_via_powersploit_modules/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Network Share Discovery](/tags/#network-share-discovery), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive) | [Lateral Movement](/tags/#lateral-movement) | TTP | -| [Reconnaissance of Credential Stores and Services via Mimikatz modules](/endpoint/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules/) | [Credentials](/tags/#credentials), [Domain Properties](/tags/#domain-properties), [Network Trust Dependencies](/tags/#network-trust-dependencies), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | [Reconnaissance](/tags/#reconnaissance) | TTP | -| [Reconnaissance of Defensive Tools via PowerSploit modules](/endpoint/reconnaissance_of_defensive_tools_via_powersploit_modules/) | [Vulnerability Scanning](/tags/#vulnerability-scanning), [Software](/tags/#software) | [Reconnaissance](/tags/#reconnaissance) | TTP | -| [Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules](/endpoint/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules](/endpoint/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Process Injection](/tags/#process-injection), [Hijack Execution Flow](/tags/#hijack-execution-flow) | [Persistence](/tags/#persistence) | TTP | -| [Recursive Delete of Directory In Batch CMD](/endpoint/recursive_delete_of_directory_in_batch_cmd/) | [File Deletion](/tags/#file-deletion) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Reg exe Manipulating Windows Services Registry Keys](/endpoint/reg_exe_manipulating_windows_services_registry_keys/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | [Persistence](/tags/#persistence) | TTP | -| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | [Persistence](/tags/#persistence) | TTP | -| [Registry Keys Used For Privilege Escalation](/endpoint/registry_keys_used_for_privilege_escalation/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [Registry Keys for Creating SHIM Databases](/endpoint/registry_keys_for_creating_shim_databases/) | [Application Shimming](/tags/#application-shimming) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [Remcos RAT File Creation in Remcos Folder](/endpoint/remcos_rat_file_creation_in_remcos_folder/) | [Screen Capture](/tags/#screen-capture) | [Collection](/tags/#collection) | TTP | -| [Remote Desktop Network Bruteforce](/network/remote_desktop_network_bruteforce/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | [Lateral Movement](/tags/#lateral-movement) | TTP | -| [Remote Desktop Network Traffic](/network/remote_desktop_network_traffic/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | [Lateral Movement](/tags/#lateral-movement) | Anomaly | -| [Remote Desktop Process Running On System](/endpoint/remote_desktop_process_running_on_system/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | [Lateral Movement](/tags/#lateral-movement) | Hunting | -| [Remote Process Instantiation via WMI](/endpoint/remote_process_instantiation_via_wmi/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [Execution](/tags/#execution) | TTP | -| [Remote System Discovery with Adsisearcher](/endpoint/remote_system_discovery_with_adsisearcher/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | TTP | -| [Remote System Discovery with Dsquery](/endpoint/remote_system_discovery_with_dsquery/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [Remote System Discovery with Net](/endpoint/remote_system_discovery_with_net/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [Remote System Discovery with Wmic](/endpoint/remote_system_discovery_with_wmic/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | TTP | -| [Remote WMI Command Attempt](/endpoint/remote_wmi_command_attempt/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [Execution](/tags/#execution) | TTP | -| [Resize ShadowStorage volume](/endpoint/resize_shadowstorage_volume/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | [Impact](/tags/#impact) | TTP | -| [Resize Shadowstorage Volume](/endpoint/resize_shadowstorage_volume/) | [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) | TTP | -| [Revil Common Exec Parameter](/endpoint/revil_common_exec_parameter/) | [User Execution](/tags/#user-execution) | [Execution](/tags/#execution) | TTP | -| [Revil Registry Entry](/endpoint/revil_registry_entry/) | [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Rundll32 Control RunDLL Hunt](/endpoint/rundll32_control_rundll_hunt/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | Hunting | -| [Rundll32 Control RunDLL World Writable Directory](/endpoint/rundll32_control_rundll_world_writable_directory/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Rundll32 Create Remote Thread To A Process](/endpoint/rundll32_create_remote_thread_to_a_process/) | [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Rundll32 CreateRemoteThread In Browser](/endpoint/rundll32_createremotethread_in_browser/) | [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Rundll32 DNSQuery](/endpoint/rundll32_dnsquery/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Rundll32 Process Creating Exe Dll Files](/endpoint/rundll32_process_creating_exe_dll_files/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Ryuk Test Files Detected](/endpoint/ryuk_test_files_detected/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) | TTP | -| [Ryuk Wake on LAN Command](/endpoint/ryuk_wake_on_lan_command/) | [Windows Command Shell](/tags/#windows-command-shell) | [Execution](/tags/#execution) | TTP | -| [SAM Database File Access Attempt](/endpoint/sam_database_file_access_attempt/) | [Security Account Manager](/tags/#security-account-manager) | [Credential Access](/tags/#credential-access) | Hunting | -| [SLUI RunAs Elevated](/endpoint/slui_runas_elevated/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [SLUI Spawning a Process](/endpoint/slui_spawning_a_process/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [SMB Traffic Spike](/network/smb_traffic_spike/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) | Anomaly | -| [SMB Traffic Spike - MLTK](/network/smb_traffic_spike_-_mltk/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) | Anomaly | -| [SQL Injection with Long URLs](/web/sql_injection_with_long_urls/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | TTP | -| [Samsam Test File Write](/endpoint/samsam_test_file_write/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) | TTP | -| [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) | TTP | -| [SchCache Change By App Connect And Create ADSI Object](/endpoint/schcache_change_by_app_connect_and_create_adsi_object/) | [Domain Account](/tags/#domain-account) | [Discovery](/tags/#discovery) | Anomaly | -| [Schedule Task with HTTP Command Arguments](/endpoint/schedule_task_with_http_command_arguments/) | [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) | TTP | -| [Schedule Task with Rundll32 Command Trigger](/endpoint/schedule_task_with_rundll32_command_trigger/) | [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) | TTP | -| [Scheduled Task Deleted Or Created via CMD](/endpoint/scheduled_task_deleted_or_created_via_cmd/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | TTP | -| [Schtasks Run Task On Demand](/endpoint/schtasks_run_task_on_demand/) | [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) | TTP | -| [Schtasks scheduling job on remote system](/endpoint/schtasks_scheduling_job_on_remote_system/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | TTP | -| [Schtasks used for forcing a reboot](/endpoint/schtasks_used_for_forcing_a_reboot/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | TTP | -| [Script Execution via WMI](/endpoint/script_execution_via_wmi/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [Execution](/tags/#execution) | TTP | -| [Sdclt UAC Bypass](/endpoint/sdclt_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [SearchProtocolHost with no Command Line with Network](/endpoint/searchprotocolhost_with_no_command_line_with_network/) | [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [SecretDumps Offline NTDS Dumping Tool](/endpoint/secretdumps_offline_ntds_dumping_tool/) | [NTDS](/tags/#ntds) | [Credential Access](/tags/#credential-access) | TTP | -| [Services Escalate Exe](/endpoint/services_escalate_exe/) | [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [Set Default PowerShell Execution Policy To Unrestricted or Bypass](/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass/) | [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) | TTP | -| [Setting Credentials via DSInternals modules](/endpoint/setting_credentials_via_dsinternals_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [Setting Credentials via Mimikatz modules](/endpoint/setting_credentials_via_mimikatz_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [Setting Credentials via PowerSploit modules](/endpoint/setting_credentials_via_powersploit_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [Shim Database File Creation](/endpoint/shim_database_file_creation/) | [Application Shimming](/tags/#application-shimming) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [Shim Database Installation With Suspicious Parameters](/endpoint/shim_database_installation_with_suspicious_parameters/) | [Application Shimming](/tags/#application-shimming) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [Short Lived Windows Accounts](/endpoint/short_lived_windows_accounts/) | [Local Account](/tags/#local-account) | [Persistence](/tags/#persistence) | TTP | -| [SilentCleanup UAC Bypass](/endpoint/silentcleanup_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [Single Letter Process On Endpoint](/endpoint/single_letter_process_on_endpoint/) | [Malicious File](/tags/#malicious-file) | [Execution](/tags/#execution) | TTP | -| [Spike in File Writes]() | None | None | Anomaly | -| [Spoolsv Spawning Rundll32](/endpoint/spoolsv_spawning_rundll32/) | [Print Processors](/tags/#print-processors) | [Persistence](/tags/#persistence) | TTP | -| [Spoolsv Suspicious Loaded Modules](/endpoint/spoolsv_suspicious_loaded_modules/) | [Print Processors](/tags/#print-processors) | [Persistence](/tags/#persistence) | TTP | -| [Spoolsv Suspicious Process Access](/endpoint/spoolsv_suspicious_process_access/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [Spoolsv Writing a DLL](/endpoint/spoolsv_writing_a_dll/) | [Print Processors](/tags/#print-processors) | [Persistence](/tags/#persistence) | TTP | -| [Spoolsv Writing a DLL - Sysmon](/endpoint/spoolsv_writing_a_dll_-_sysmon/) | [Print Processors](/tags/#print-processors) | [Persistence](/tags/#persistence) | TTP | -| [Sqlite Module In Temp Folder](/endpoint/sqlite_module_in_temp_folder/) | [Data from Local System](/tags/#data-from-local-system) | [Collection](/tags/#collection) | TTP | -| [Start Up During Safe Mode Boot](/endpoint/start_up_during_safe_mode_boot/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | [Persistence](/tags/#persistence) | TTP | -| [Sunburst Correlation DLL and Network Event](/endpoint/sunburst_correlation_dll_and_network_event/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) | TTP | -| [Supernova Webshell](/web/supernova_webshell/) | [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) | TTP | -| [Suspicious Curl Network Connection](/endpoint/suspicious_curl_network_connection/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control) | TTP | -| [Suspicious DLLHost no Command Line Arguments](/endpoint/suspicious_dllhost_no_command_line_arguments/) | [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Suspicious Driver Loaded Path](/endpoint/suspicious_driver_loaded_path/) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) | TTP | -| [Suspicious Email Attachment Extensions](/application/suspicious_email_attachment_extensions/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | Anomaly | -| [Suspicious Event Log Service Behavior](/endpoint/suspicious_event_log_service_behavior/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Suspicious GPUpdate no Command Line Arguments](/endpoint/suspicious_gpupdate_no_command_line_arguments/) | [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Suspicious IcedID Regsvr32 Cmdline](/endpoint/suspicious_icedid_regsvr32_cmdline/) | [Regsvr32](/tags/#regsvr32) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Suspicious IcedID Rundll32 Cmdline](/endpoint/suspicious_icedid_rundll32_cmdline/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Suspicious Image Creation In Appdata Folder](/endpoint/suspicious_image_creation_in_appdata_folder/) | [Screen Capture](/tags/#screen-capture) | [Collection](/tags/#collection) | TTP | -| [Suspicious Java Classes]() | None | None | Anomaly | -| [Suspicious MSBuild Rename](/endpoint/suspicious_msbuild_rename/) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Suspicious MSBuild Spawn](/endpoint/suspicious_msbuild_spawn/) | [MSBuild](/tags/#msbuild) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Suspicious PlistBuddy Usage](/endpoint/suspicious_plistbuddy_usage/) | [Launch Agent](/tags/#launch-agent) | [Persistence](/tags/#persistence) | TTP | -| [Suspicious PlistBuddy Usage via OSquery](/endpoint/suspicious_plistbuddy_usage_via_osquery/) | [Launch Agent](/tags/#launch-agent) | [Persistence](/tags/#persistence) | TTP | -| [Suspicious Process File Path](/endpoint/suspicious_process_file_path/) | [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) | TTP | -| [Suspicious Reg exe Process](/endpoint/suspicious_reg_exe_process/) | [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Suspicious Regsvr32 Register Suspicious Path](/endpoint/suspicious_regsvr32_register_suspicious_path/) | [Regsvr32](/tags/#regsvr32) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Suspicious Rundll32 PluginInit](/endpoint/suspicious_rundll32_plugininit/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Suspicious Rundll32 Rename](/endpoint/suspicious_rundll32_rename/) | [Rundll32](/tags/#rundll32), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | Hunting | -| [Suspicious Rundll32 StartW](/endpoint/suspicious_rundll32_startw/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Suspicious Rundll32 dllregisterserver](/endpoint/suspicious_rundll32_dllregisterserver/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Suspicious Rundll32 no Command Line Arguments](/endpoint/suspicious_rundll32_no_command_line_arguments/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Suspicious SQLite3 LSQuarantine Behavior](/endpoint/suspicious_sqlite3_lsquarantine_behavior/) | [Data Staged](/tags/#data-staged) | [Collection](/tags/#collection) | TTP | -| [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | Anomaly | -| [Suspicious SearchProtocolHost no Command Line Arguments](/endpoint/suspicious_searchprotocolhost_no_command_line_arguments/) | [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Suspicious WAV file in Appdata Folder](/endpoint/suspicious_wav_file_in_appdata_folder/) | [Screen Capture](/tags/#screen-capture) | [Collection](/tags/#collection) | TTP | -| [Suspicious microsoft workflow compiler rename](/endpoint/suspicious_microsoft_workflow_compiler_rename/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | Hunting | -| [Suspicious microsoft workflow compiler usage](/endpoint/suspicious_microsoft_workflow_compiler_usage/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Suspicious msbuild path](/endpoint/suspicious_msbuild_path/) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Suspicious mshta child process](/endpoint/suspicious_mshta_child_process/) | [Mshta](/tags/#mshta) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Suspicious mshta spawn](/endpoint/suspicious_mshta_spawn/) | [Mshta](/tags/#mshta) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Suspicious wevtutil Usage](/endpoint/suspicious_wevtutil_usage/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Suspicious writes to windows Recycle Bin](/endpoint/suspicious_writes_to_windows_recycle_bin/) | [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [System Information Discovery Detection](/endpoint/system_information_discovery_detection/) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) | TTP | -| [System Process Running from Unexpected Location](/endpoint/system_process_running_from_unexpected_location/) | [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) | Anomaly | -| [System Processes Run From Unexpected Locations](/endpoint/system_processes_run_from_unexpected_locations/) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [System User Discovery With Query](/endpoint/system_user_discovery_with_query/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [System User Discovery With Whoami](/endpoint/system_user_discovery_with_whoami/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [TOR Traffic](/network/tor_traffic/) | [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) | TTP | -| [Trickbot Named Pipe](/endpoint/trickbot_named_pipe/) | [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [UAC Bypass With Colorui COM Object](/endpoint/uac_bypass_with_colorui_com_object/) | [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [USN Journal Deletion](/endpoint/usn_journal_deletion/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Unified Messaging Service Spawning a Process](/endpoint/unified_messaging_service_spawning_a_process/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | TTP | -| [Uninstall App Using MsiExec](/endpoint/uninstall_app_using_msiexec/) | [Msiexec](/tags/#msiexec) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Unload Sysmon Filter Driver](/endpoint/unload_sysmon_filter_driver/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Unloading AMSI via Reflection](/endpoint/unloading_amsi_via_reflection/) | [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Unusually Long Command Line]() | None | None | Anomaly | -| [Unusually Long Command Line]() | None | None | Anomaly | -| [Unusually Long Command Line - MLTK]() | None | None | Anomaly | -| [Unusually Long Content-Type Length]() | None | None | Anomaly | -| [User Discovery With Env Vars PowerShell](/endpoint/user_discovery_with_env_vars_powershell/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [User Discovery With Env Vars PowerShell Script Block](/endpoint/user_discovery_with_env_vars_powershell_script_block/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) | Hunting | -| [W3WP Spawning Shell](/endpoint/w3wp_spawning_shell/) | [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) | TTP | -| [WBAdmin Delete System Backups](/endpoint/wbadmin_delete_system_backups/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | [Impact](/tags/#impact) | TTP | -| [WMI Permanent Event Subscription](/endpoint/wmi_permanent_event_subscription/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [Execution](/tags/#execution) | TTP | -| [WMI Permanent Event Subscription - Sysmon](/endpoint/wmi_permanent_event_subscription_-_sysmon/) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [WMI Recon Running Process Or Services](/endpoint/wmi_recon_running_process_or_services/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | [Reconnaissance](/tags/#reconnaissance) | TTP | -| [WMI Temporary Event Subscription](/endpoint/wmi_temporary_event_subscription/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [Execution](/tags/#execution) | TTP | -| [WSReset UAC Bypass](/endpoint/wsreset_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | [Privilege Escalation](/tags/#privilege-escalation) | TTP | -| [Wbemprox COM Object Execution](/endpoint/wbemprox_com_object_execution/) | [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Web Servers Executing Suspicious Processes](/application/web_servers_executing_suspicious_processes/) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) | TTP | -| [Wermgr Process Connecting To IP Check Web Services](/endpoint/wermgr_process_connecting_to_ip_check_web_services/) | [IP Addresses](/tags/#ip-addresses) | [Reconnaissance](/tags/#reconnaissance) | TTP | -| [Wermgr Process Create Executable File](/endpoint/wermgr_process_create_executable_file/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Wermgr Process Spawned CMD Or Powershell Process](/endpoint/wermgr_process_spawned_cmd_or_powershell_process/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Execution](/tags/#execution) | TTP | -| [WevtUtil Usage To Clear Logs](/endpoint/wevtutil_usage_to_clear_logs/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Wevtutil Usage To Disable Logs](/endpoint/wevtutil_usage_to_disable_logs/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | TTP | -| [WinEvent Scheduled Task Created to Spawn Shell](/endpoint/winevent_scheduled_task_created_to_spawn_shell/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | TTP | -| [WinRM Spawning a Process](/endpoint/winrm_spawning_a_process/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | TTP | -| [Windows AdFind Exe](/endpoint/windows_adfind_exe/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | TTP | -| [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Windows Event Log Cleared](/endpoint/windows_event_log_cleared/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [Windows Security Account Manager Stopped](/endpoint/windows_security_account_manager_stopped/) | [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) | TTP | -| [Winword Spawning Cmd](/endpoint/winword_spawning_cmd/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | TTP | -| [Winword Spawning PowerShell](/endpoint/winword_spawning_powershell/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | TTP | -| [Winword Spawning Windows Script Host](/endpoint/winword_spawning_windows_script_host/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | TTP | -| [Wmic Group Discovery](/endpoint/wmic_group_discovery/) | [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) | Hunting | -| [Write Executable in SMB Share](/endpoint/write_executable_in_smb_share/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) | TTP | -| [XMRIG Driver Loaded](/endpoint/xmrig_driver_loaded/) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) | TTP | -| [XSL Script Execution With WMIC](/endpoint/xsl_script_execution_with_wmic/) | [XSL Script Processing](/tags/#xsl-script-processing) | [Defense Evasion](/tags/#defense-evasion) | TTP | -| [aws detect attach to role policy](/cloud/aws_detect_attach_to_role_policy/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | Hunting | -| [aws detect permanent key creation](/cloud/aws_detect_permanent_key_creation/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | Hunting | -| [aws detect role creation](/cloud/aws_detect_role_creation/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | Hunting | -| [aws detect sts assume role abuse](/cloud/aws_detect_sts_assume_role_abuse/) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | Hunting | -| [aws detect sts get session token abuse](/cloud/aws_detect_sts_get_session_token_abuse/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material) | [Defense Evasion](/tags/#defense-evasion) | Hunting | \ No newline at end of file +| Name | Technique | Type | +| --------| --------- |------------| +| [7zip CommandLine To SMB Share Path](/endpoint/7zip_commandline_to_smb_share_path/) | [Archive via Utility](/tags/#archive-via-utility) | Hunting | +| [AWS Create Policy Version to allow all resources](/cloud/aws_create_policy_version_to_allow_all_resources/) | [Cloud Accounts](/tags/#cloud-accounts) | TTP | +| [AWS CreateAccessKey](/cloud/aws_createaccesskey/) | [Cloud Account](/tags/#cloud-account) | Hunting | +| [AWS CreateLoginProfile](/cloud/aws_createloginprofile/) | [Cloud Account](/tags/#cloud-account) | TTP | +| [AWS Cross Account Activity From Previously Unseen Account]() | None | Anomaly | +| [AWS Detect Users creating keys with encrypt policy without MFA](/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | TTP | +| [AWS Detect Users with KMS keys performing encryption S3](/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | Anomaly | +| [AWS ECR Container Scanning Findings High](/cloud/aws_ecr_container_scanning_findings_high/) | [Malicious Image](/tags/#malicious-image) | TTP | +| [AWS ECR Container Scanning Findings Low Informational Unknown](/cloud/aws_ecr_container_scanning_findings_low_informational_unknown/) | [Malicious Image](/tags/#malicious-image) | Hunting | +| [AWS ECR Container Scanning Findings Medium](/cloud/aws_ecr_container_scanning_findings_medium/) | [Malicious Image](/tags/#malicious-image) | Anomaly | +| [AWS ECR Container Upload Outside Business Hours](/cloud/aws_ecr_container_upload_outside_business_hours/) | [Malicious Image](/tags/#malicious-image) | Anomaly | +| [AWS ECR Container Upload Unknown User](/cloud/aws_ecr_container_upload_unknown_user/) | [Malicious Image](/tags/#malicious-image) | Anomaly | +| [AWS Excessive Security Scanning](/cloud/aws_excessive_security_scanning/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | TTP | +| [AWS IAM AccessDenied Discovery Events](/cloud/aws_iam_accessdenied_discovery_events/) | [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery) | Anomaly | +| [AWS IAM Assume Role Policy Brute Force](/cloud/aws_iam_assume_role_policy_brute_force/) | [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [Brute Force](/tags/#brute-force) | TTP | +| [AWS IAM Delete Policy](/cloud/aws_iam_delete_policy/) | [Account Manipulation](/tags/#account-manipulation) | Hunting | +| [AWS IAM Failure Group Deletion](/cloud/aws_iam_failure_group_deletion/) | [Account Manipulation](/tags/#account-manipulation) | Anomaly | +| [AWS IAM Successful Group Deletion](/cloud/aws_iam_successful_group_deletion/) | [Cloud Groups](/tags/#cloud-groups), [Account Manipulation](/tags/#account-manipulation) | Hunting | +| [AWS Network Access Control List Created with All Open Ports](/cloud/aws_network_access_control_list_created_with_all_open_ports/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | TTP | +| [AWS Network Access Control List Deleted](/cloud/aws_network_access_control_list_deleted/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | Anomaly | +| [AWS SAML Access by Provider User and Principal](/cloud/aws_saml_access_by_provider_user_and_principal/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly | +| [AWS SAML Update identity provider](/cloud/aws_saml_update_identity_provider/) | [Valid Accounts](/tags/#valid-accounts) | TTP | +| [AWS SetDefaultPolicyVersion](/cloud/aws_setdefaultpolicyversion/) | [Cloud Accounts](/tags/#cloud-accounts) | TTP | +| [AWS UpdateLoginProfile](/cloud/aws_updateloginprofile/) | [Cloud Account](/tags/#cloud-account) | TTP | +| [Abnormally High Number Of Cloud Infrastructure API Calls](/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | +| [Abnormally High Number Of Cloud Instances Destroyed](/cloud/abnormally_high_number_of_cloud_instances_destroyed/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | +| [Abnormally High Number Of Cloud Instances Launched](/cloud/abnormally_high_number_of_cloud_instances_launched/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | +| [Abnormally High Number Of Cloud Security Group API Calls](/cloud/abnormally_high_number_of_cloud_security_group_api_calls/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | +| [Access LSASS Memory for Dump Creation](/endpoint/access_lsass_memory_for_dump_creation/) | [LSASS Memory](/tags/#lsass-memory) | TTP | +| [Account Discovery With Net App](/endpoint/account_discovery_with_net_app/) | [Domain Account](/tags/#domain-account) | TTP | +| [Add DefaultUser And Password In Registry](/endpoint/add_defaultuser_and_password_in_registry/) | [Credentials in Registry](/tags/#credentials-in-registry) | Anomaly | +| [AdsiSearcher Account Discovery](/endpoint/adsisearcher_account_discovery/) | [Domain Account](/tags/#domain-account) | TTP | +| [Allow File And Printing Sharing In Firewall](/endpoint/allow_file_and_printing_sharing_in_firewall/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | TTP | +| [Allow Inbound Traffic By Firewall Rule Registry](/endpoint/allow_inbound_traffic_by_firewall_rule_registry/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | TTP | +| [Allow Inbound Traffic In Firewall Rule](/endpoint/allow_inbound_traffic_in_firewall_rule/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | TTP | +| [Allow Network Discovery In Firewall](/endpoint/allow_network_discovery_in_firewall/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | TTP | +| [Allow Operation with Consent Admin](/endpoint/allow_operation_with_consent_admin/) | [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [Amazon EKS Kubernetes Pod scan detection](/cloud/amazon_eks_kubernetes_pod_scan_detection/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | Hunting | +| [Amazon EKS Kubernetes cluster scan detection](/cloud/amazon_eks_kubernetes_cluster_scan_detection/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | Hunting | +| [Anomalous usage of 7zip](/endpoint/anomalous_usage_of_7zip/) | [Archive via Utility](/tags/#archive-via-utility) | Anomaly | +| [Any Powershell DownloadFile](/endpoint/any_powershell_downloadfile/) | [PowerShell](/tags/#powershell) | TTP | +| [Any Powershell DownloadString](/endpoint/any_powershell_downloadstring/) | [PowerShell](/tags/#powershell) | TTP | +| [Applying Stolen Credentials via Mimikatz modules](/endpoint/applying_stolen_credentials_via_mimikatz_modules/) | [Process Injection](/tags/#process-injection), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Access Token Manipulation](/tags/#access-token-manipulation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Modify Authentication Process](/tags/#modify-authentication-process), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | TTP | +| [Applying Stolen Credentials via PowerSploit modules](/endpoint/applying_stolen_credentials_via_powersploit_modules/) | [Process Injection](/tags/#process-injection), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Access Token Manipulation](/tags/#access-token-manipulation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | TTP | +| [Assessment of Credential Strength via DSInternals modules](/endpoint/assessment_of_credential_strength_via_dsinternals_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Account Discovery](/tags/#account-discovery), [Password Policy Discovery](/tags/#password-policy-discovery), [Unsecured Credentials](/tags/#unsecured-credentials), [Credentials from Password Stores](/tags/#credentials-from-password-stores) | TTP | +| [Attacker Tools On Endpoint](/endpoint/attacker_tools_on_endpoint/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Attempt To Add Certificate To Untrusted Store](/endpoint/attempt_to_add_certificate_to_untrusted_store/) | [Install Root Certificate](/tags/#install-root-certificate) | TTP | +| [Attempt To Disable Services](/endpoint/attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | TTP | +| [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Attempt To delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop) | TTP | +| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager) | TTP | +| [Auto Admin Logon Registry Entry](/endpoint/auto_admin_logon_registry_entry/) | [Credentials in Registry](/tags/#credentials-in-registry) | TTP | +| [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | +| [BITS Job Persistence](/endpoint/bits_job_persistence/) | [BITS Jobs](/tags/#bits-jobs) | TTP | +| [BITSAdmin Download File](/endpoint/bitsadmin_download_file/) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | +| [Batch File Write to System32](/endpoint/batch_file_write_to_system32/) | [Malicious File](/tags/#malicious-file) | TTP | +| [Bcdedit Command Back To Normal Mode Boot](/endpoint/bcdedit_command_back_to_normal_mode_boot/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | +| [CHCP Command Execution](/endpoint/chcp_command_execution/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | +| [CMD Echo Pipe - Escalation](/endpoint/cmd_echo_pipe_-_escalation/) | [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service) | TTP | +| [CMLUA Or CMSTPLUA UAC Bypass](/endpoint/cmlua_or_cmstplua_uac_bypass/) | [CMSTP](/tags/#cmstp) | TTP | +| [CertUtil Download With URLCache and Split Arguments](/endpoint/certutil_download_with_urlcache_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | +| [CertUtil Download With VerifyCtl and Split Arguments](/endpoint/certutil_download_with_verifyctl_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | +| [CertUtil With Decode Argument](/endpoint/certutil_with_decode_argument/) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information) | TTP | +| [Certutil exe certificate extraction]() | None | TTP | +| [Change To Safe Mode With Network Config](/endpoint/change_to_safe_mode_with_network_config/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | +| [Check Elevated CMD using whoami](/endpoint/check_elevated_cmd_using_whoami/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | TTP | +| [Child Processes of Spoolsv exe](/endpoint/child_processes_of_spoolsv_exe/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | TTP | +| [Circle CI Disable Security Job](/cloud/circle_ci_disable_security_job/) | [Compromise Client Software Binary](/tags/#compromise-client-software-binary) | Anomaly | +| [Circle CI Disable Security Step](/cloud/circle_ci_disable_security_step/) | [Compromise Client Software Binary](/tags/#compromise-client-software-binary) | Anomaly | +| [Clear Unallocated Sector Using Cipher App](/endpoint/clear_unallocated_sector_using_cipher_app/) | [File Deletion](/tags/#file-deletion) | TTP | +| [Clop Common Exec Parameter](/endpoint/clop_common_exec_parameter/) | [User Execution](/tags/#user-execution) | TTP | +| [Clop Ransomware Known Service Name](/endpoint/clop_ransomware_known_service_name/) | [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | +| [Cloud API Calls From Previously Unseen User Roles](/cloud/cloud_api_calls_from_previously_unseen_user_roles/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly | +| [Cloud Compute Instance Created By Previously Unseen User](/cloud/cloud_compute_instance_created_by_previously_unseen_user/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | +| [Cloud Compute Instance Created In Previously Unused Region](/cloud/cloud_compute_instance_created_in_previously_unused_region/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | Anomaly | +| [Cloud Compute Instance Created With Previously Unseen Image]() | None | Anomaly | +| [Cloud Compute Instance Created With Previously Unseen Instance Type]() | None | Anomaly | +| [Cloud Instance Modified By Previously Unseen User](/cloud/cloud_instance_modified_by_previously_unseen_user/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | +| [Cloud Provisioning Activity From Previously Unseen City](/cloud/cloud_provisioning_activity_from_previously_unseen_city/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly | +| [Cloud Provisioning Activity From Previously Unseen Country](/cloud/cloud_provisioning_activity_from_previously_unseen_country/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly | +| [Cloud Provisioning Activity From Previously Unseen IP Address](/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly | +| [Cloud Provisioning Activity From Previously Unseen Region](/cloud/cloud_provisioning_activity_from_previously_unseen_region/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly | +| [Cmdline Tool Not Executed In CMD Shell](/endpoint/cmdline_tool_not_executed_in_cmd_shell/) | [JavaScript](/tags/#javascript) | TTP | +| [Cobalt Strike Named Pipes](/endpoint/cobalt_strike_named_pipes/) | [Process Injection](/tags/#process-injection) | TTP | +| [Common Ransomware Extensions](/endpoint/common_ransomware_extensions/) | [Data Destruction](/tags/#data-destruction) | Hunting | +| [Common Ransomware Notes](/endpoint/common_ransomware_notes/) | [Data Destruction](/tags/#data-destruction) | Hunting | +| [Conti Common Exec parameter](/endpoint/conti_common_exec_parameter/) | [User Execution](/tags/#user-execution) | TTP | +| [Control Loading from World Writable Directory](/endpoint/control_loading_from_world_writable_directory/) | [Control Panel](/tags/#control-panel) | TTP | +| [Correlation by Repository and Risk](/cloud/correlation_by_repository_and_risk/) | [Malicious Image](/tags/#malicious-image) | Correlation | +| [Correlation by User and Risk](/cloud/correlation_by_user_and_risk/) | [Malicious Image](/tags/#malicious-image) | Correlation | +| [Create Remote Thread In Shell Application](/endpoint/create_remote_thread_in_shell_application/) | [Process Injection](/tags/#process-injection) | TTP | +| [Create Remote Thread into LSASS](/endpoint/create_remote_thread_into_lsass/) | [LSASS Memory](/tags/#lsass-memory) | TTP | +| [Create Service In Suspicious File Path](/endpoint/create_service_in_suspicious_file_path/) | [Service Execution](/tags/#service-execution) | TTP | +| [Create local admin accounts using net exe](/endpoint/create_local_admin_accounts_using_net_exe/) | [Local Account](/tags/#local-account) | TTP | +| [Create or delete windows shares using net exe](/endpoint/create_or_delete_windows_shares_using_net_exe/) | [Network Share Connection Removal](/tags/#network-share-connection-removal) | TTP | +| [Creation of Shadow Copy](/endpoint/creation_of_shadow_copy/) | [NTDS](/tags/#ntds) | TTP | +| [Creation of Shadow Copy with wmic and powershell](/endpoint/creation_of_shadow_copy_with_wmic_and_powershell/) | [NTDS](/tags/#ntds) | TTP | +| [Creation of lsass Dump with Taskmgr](/endpoint/creation_of_lsass_dump_with_taskmgr/) | [LSASS Memory](/tags/#lsass-memory) | TTP | +| [Credential Dumping via Copy Command from Shadow Copy](/endpoint/credential_dumping_via_copy_command_from_shadow_copy/) | [NTDS](/tags/#ntds) | TTP | +| [Credential Dumping via Symlink to Shadow Copy](/endpoint/credential_dumping_via_symlink_to_shadow_copy/) | [NTDS](/tags/#ntds) | TTP | +| [Credential Extraction indicative of FGDump and CacheDump with s option](/endpoint/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Credential Extraction indicative of FGDump and CacheDump with v option](/endpoint/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Credential Extraction indicative of Lazagne command line options](/endpoint/credential_extraction_indicative_of_lazagne_command_line_options/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Credentials from Password Stores](/tags/#credentials-from-password-stores) | TTP | +| [Credential Extraction indicative of use of DSInternals credential conversion modules](/endpoint/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Credential Extraction indicative of use of DSInternals modules](/endpoint/credential_extraction_indicative_of_use_of_dsinternals_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Credential Extraction indicative of use of Mimikatz modules](/endpoint/credential_extraction_indicative_of_use_of_mimikatz_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Credential Extraction indicative of use of PowerSploit modules](/endpoint/credential_extraction_indicative_of_use_of_powersploit_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Credential Extraction native Microsoft debuggers peek into the kernel](/endpoint/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Credential Extraction native Microsoft debuggers via z command line option](/endpoint/credential_extraction_native_microsoft_debuggers_via_z_command_line_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals](/endpoint/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [DLLHost with no Command Line Arguments with Network](/endpoint/dllhost_with_no_command_line_arguments_with_network/) | [Process Injection](/tags/#process-injection) | TTP | +| [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP | +| [DNS Query Length Outliers - MLTK](/network/dns_query_length_outliers_-_mltk/) | [DNS](/tags/#dns) | Anomaly | +| [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | Anomaly | +| [DSQuery Domain Discovery](/endpoint/dsquery_domain_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | +| [Delete A Net User](/endpoint/delete_a_net_user/) | [Service Stop](/tags/#service-stop) | Anomaly | +| [Delete ShadowCopy With PowerShell](/endpoint/delete_shadowcopy_with_powershell/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | +| [Deleting Of Net Users](/endpoint/deleting_of_net_users/) | [Account Access Removal](/tags/#account-access-removal) | TTP | +| [Deleting Shadow Copies](/endpoint/deleting_shadow_copies/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | +| [Deny Permission using Cacls Utility](/endpoint/deny_permission_using_cacls_utility/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP | +| [Detect ARP Poisoning](/network/detect_arp_poisoning/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | +| [Detect AWS Console Login by New User]() | None | Hunting | +| [Detect AWS Console Login by User from New City](/cloud/detect_aws_console_login_by_user_from_new_city/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | Hunting | +| [Detect AWS Console Login by User from New Country](/cloud/detect_aws_console_login_by_user_from_new_country/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | Hunting | +| [Detect AWS Console Login by User from New Region](/cloud/detect_aws_console_login_by_user_from_new_region/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | Hunting | +| [Detect Activity Related to Pass the Hash Attacks](/endpoint/detect_activity_related_to_pass_the_hash_attacks/) | [Pass the Hash](/tags/#pass-the-hash) | TTP | +| [Detect AzureHound Command-Line Arguments](/endpoint/detect_azurehound_command-line_arguments/) | [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups) | TTP | +| [Detect AzureHound File Modifications](/endpoint/detect_azurehound_file_modifications/) | [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups) | TTP | +| [Detect Baron Samedit CVE-2021-3156](/endpoint/detect_baron_samedit_cve-2021-3156/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | TTP | +| [Detect Baron Samedit CVE-2021-3156 Segfault](/endpoint/detect_baron_samedit_cve-2021-3156_segfault/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | TTP | +| [Detect Baron Samedit CVE-2021-3156 via OSQuery](/endpoint/detect_baron_samedit_cve-2021-3156_via_osquery/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | TTP | +| [Detect Computer Changed with Anonymous Account](/endpoint/detect_computer_changed_with_anonymous_account/) | [Exploitation of Remote Services](/tags/#exploitation-of-remote-services) | Hunting | +| [Detect Copy of ShadowCopy with Script Block Logging](/endpoint/detect_copy_of_shadowcopy_with_script_block_logging/) | [Security Account Manager](/tags/#security-account-manager) | TTP | +| [Detect Credential Dumping through LSASS access](/endpoint/detect_credential_dumping_through_lsass_access/) | [LSASS Memory](/tags/#lsass-memory) | TTP | +| [Detect Dump LSASS Memory using comsvcs](/endpoint/detect_dump_lsass_memory_using_comsvcs/) | [NTDS](/tags/#ntds) | TTP | +| [Detect Empire with PowerShell Script Block Logging](/endpoint/detect_empire_with_powershell_script_block_logging/) | [PowerShell](/tags/#powershell) | TTP | +| [Detect Excessive Account Lockouts From Endpoint](/endpoint/detect_excessive_account_lockouts_from_endpoint/) | [Domain Accounts](/tags/#domain-accounts) | Anomaly | +| [Detect Excessive User Account Lockouts](/endpoint/detect_excessive_user_account_lockouts/) | [Local Accounts](/tags/#local-accounts) | Anomaly | +| [Detect Exchange Web Shell](/endpoint/detect_exchange_web_shell/) | [Web Shell](/tags/#web-shell) | TTP | +| [Detect F5 TMUI RCE CVE-2020-5902](/web/detect_f5_tmui_rce_cve-2020-5902/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | +| [Detect GCP Storage access from a new IP](/cloud/detect_gcp_storage_access_from_a_new_ip/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | Anomaly | +| [Detect HTML Help Renamed](/endpoint/detect_html_help_renamed/) | [Compiled HTML File](/tags/#compiled-html-file) | Hunting | +| [Detect HTML Help Spawn Child Process](/endpoint/detect_html_help_spawn_child_process/) | [Compiled HTML File](/tags/#compiled-html-file) | TTP | +| [Detect HTML Help URL in Command Line](/endpoint/detect_html_help_url_in_command_line/) | [Compiled HTML File](/tags/#compiled-html-file) | TTP | +| [Detect HTML Help Using InfoTech Storage Handlers](/endpoint/detect_html_help_using_infotech_storage_handlers/) | [Compiled HTML File](/tags/#compiled-html-file) | TTP | +| [Detect IPv6 Network Infrastructure Threats](/network/detect_ipv6_network_infrastructure_threats/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | +| [Detect Kerberoasting](/endpoint/detect_kerberoasting/) | [Kerberoasting](/tags/#kerberoasting) | TTP | +| [Detect Large Outbound ICMP Packets](/network/detect_large_outbound_icmp_packets/) | [Non-Application Layer Protocol](/tags/#non-application-layer-protocol) | TTP | +| [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [Mshta](/tags/#mshta) | TTP | +| [Detect Mimikatz Using Loaded Images](/endpoint/detect_mimikatz_using_loaded_images/) | [LSASS Memory](/tags/#lsass-memory) | TTP | +| [Detect Mimikatz With PowerShell Script Block Logging](/endpoint/detect_mimikatz_with_powershell_script_block_logging/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Detect New Local Admin account](/endpoint/detect_new_local_admin_account/) | [Local Account](/tags/#local-account) | TTP | +| [Detect New Login Attempts to Routers]() | None | TTP | +| [Detect New Open GCP Storage Buckets](/cloud/detect_new_open_gcp_storage_buckets/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | TTP | +| [Detect New Open S3 Buckets over AWS CLI](/cloud/detect_new_open_s3_buckets_over_aws_cli/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | TTP | +| [Detect New Open S3 buckets](/cloud/detect_new_open_s3_buckets/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | TTP | +| [Detect Outbound SMB Traffic](/network/detect_outbound_smb_traffic/) | [File Transfer Protocols](/tags/#file-transfer-protocols) | TTP | +| [Detect Outlook exe writing a zip file](/endpoint/detect_outlook_exe_writing_a_zip_file/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Detect Pass the Hash](/endpoint/detect_pass_the_hash/) | [Pass the Hash](/tags/#pass-the-hash) | TTP | +| [Detect Path Interception By Creation Of program exe](/endpoint/detect_path_interception_by_creation_of_program_exe/) | [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path) | TTP | +| [Detect Port Security Violation](/network/detect_port_security_violation/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | +| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Windows Command Shell](/tags/#windows-command-shell) | Hunting | +| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | +| [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | +| [Detect RClone Command-Line Usage](/endpoint/detect_rclone_command-line_usage/) | [Automated Exfiltration](/tags/#automated-exfiltration) | TTP | +| [Detect Rare Executables]() | None | Anomaly | +| [Detect Regasm Spawning a Process](/endpoint/detect_regasm_spawning_a_process/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | +| [Detect Regasm with Network Connection](/endpoint/detect_regasm_with_network_connection/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | +| [Detect Regasm with no Command Line Arguments](/endpoint/detect_regasm_with_no_command_line_arguments/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | +| [Detect Regsvcs Spawning a Process](/endpoint/detect_regsvcs_spawning_a_process/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | +| [Detect Regsvcs with Network Connection](/endpoint/detect_regsvcs_with_network_connection/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | +| [Detect Regsvcs with No Command Line Arguments](/endpoint/detect_regsvcs_with_no_command_line_arguments/) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | TTP | +| [Detect Regsvr32 Application Control Bypass](/endpoint/detect_regsvr32_application_control_bypass/) | [Regsvr32](/tags/#regsvr32) | TTP | +| [Detect Renamed 7-Zip](/endpoint/detect_renamed_7-zip/) | [Archive via Utility](/tags/#archive-via-utility) | Hunting | +| [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [Service Execution](/tags/#service-execution) | Hunting | +| [Detect Renamed RClone](/endpoint/detect_renamed_rclone/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Hunting | +| [Detect Renamed WinRAR](/endpoint/detect_renamed_winrar/) | [Archive via Utility](/tags/#archive-via-utility) | Hunting | +| [Detect Rogue DHCP Server](/network/detect_rogue_dhcp_server/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle) | TTP | +| [Detect Rundll32 Application Control Bypass - advpack](/endpoint/detect_rundll32_application_control_bypass_-_advpack/) | [Rundll32](/tags/#rundll32) | TTP | +| [Detect Rundll32 Application Control Bypass - setupapi](/endpoint/detect_rundll32_application_control_bypass_-_setupapi/) | [Rundll32](/tags/#rundll32) | TTP | +| [Detect Rundll32 Application Control Bypass - syssetup](/endpoint/detect_rundll32_application_control_bypass_-_syssetup/) | [Rundll32](/tags/#rundll32) | TTP | +| [Detect Rundll32 Inline HTA Execution](/endpoint/detect_rundll32_inline_hta_execution/) | [Mshta](/tags/#mshta) | TTP | +| [Detect S3 access from a new IP](/cloud/detect_s3_access_from_a_new_ip/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | Anomaly | +| [Detect SNICat SNI Exfiltration](/network/detect_snicat_sni_exfiltration/) | [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel) | TTP | +| [Detect SharpHound Command-Line Arguments](/endpoint/detect_sharphound_command-line_arguments/) | [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups) | TTP | +| [Detect SharpHound File Modifications](/endpoint/detect_sharphound_file_modifications/) | [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups) | TTP | +| [Detect SharpHound Usage](/endpoint/detect_sharphound_usage/) | [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups) | TTP | +| [Detect Software Download To Network Device](/network/detect_software_download_to_network_device/) | [TFTP Boot](/tags/#tftp-boot) | TTP | +| [Detect Spike in AWS Security Hub Alerts for EC2 Instance]() | None | Anomaly | +| [Detect Spike in AWS Security Hub Alerts for User]() | None | Anomaly | +| [Detect Spike in S3 Bucket deletion](/cloud/detect_spike_in_s3_bucket_deletion/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | Anomaly | +| [Detect Spike in blocked Outbound Traffic from your AWS]() | None | Anomaly | +| [Detect Traffic Mirroring](/network/detect_traffic_mirroring/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Traffic Duplication](/tags/#traffic-duplication) | TTP | +| [Detect Unauthorized Assets by MAC address]() | None | TTP | +| [Detect Use of cmd exe to Launch Script Interpreters](/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters/) | [Windows Command Shell](/tags/#windows-command-shell) | TTP | +| [Detect WMI Event Subscription Persistence](/endpoint/detect_wmi_event_subscription_persistence/) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription) | TTP | +| [Detect Windows DNS SIGRed via Splunk Stream](/network/detect_windows_dns_sigred_via_splunk_stream/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | TTP | +| [Detect Windows DNS SIGRed via Zeek](/network/detect_windows_dns_sigred_via_zeek/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | TTP | +| [Detect Zerologon via Zeek](/network/detect_zerologon_via_zeek/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | +| [Detect attackers scanning for vulnerable JBoss servers](/web/detect_attackers_scanning_for_vulnerable_jboss_servers/) | [System Information Discovery](/tags/#system-information-discovery) | TTP | +| [Detect hosts connecting to dynamic domain providers](/network/detect_hosts_connecting_to_dynamic_domain_providers/) | [Drive-by Compromise](/tags/#drive-by-compromise) | TTP | +| [Detect malicious requests to exploit JBoss servers]() | None | TTP | +| [Detect mshta inline hta execution](/endpoint/detect_mshta_inline_hta_execution/) | [Mshta](/tags/#mshta) | TTP | +| [Detect mshta renamed](/endpoint/detect_mshta_renamed/) | [Mshta](/tags/#mshta) | Hunting | +| [Detect processes used for System Network Configuration Discovery](/endpoint/detect_processes_used_for_system_network_configuration_discovery/) | [System Network Configuration Discovery](/tags/#system-network-configuration-discovery) | TTP | +| [Detect shared ec2 snapshot](/cloud/detect_shared_ec2_snapshot/) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | TTP | +| [Detection of tools built by NirSoft](/endpoint/detection_of_tools_built_by_nirsoft/) | [Software Deployment Tools](/tags/#software-deployment-tools) | TTP | +| [Disable AMSI Through Registry](/endpoint/disable_amsi_through_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Disable ETW Through Registry](/endpoint/disable_etw_through_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Disable Logs Using WevtUtil](/endpoint/disable_logs_using_wevtutil/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Disable Net User Account](/endpoint/disable_net_user_account/) | [Service Stop](/tags/#service-stop) | TTP | +| [Disable Registry Tool](/endpoint/disable_registry_tool/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Disable Show Hidden Files](/endpoint/disable_show_hidden_files/) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Disable Windows App Hotkeys](/endpoint/disable_windows_app_hotkeys/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Disable Windows Behavior Monitoring](/endpoint/disable_windows_behavior_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Disable Windows SmartScreen Protection](/endpoint/disable_windows_smartscreen_protection/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Disabling CMD Application](/endpoint/disabling_cmd_application/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Disabling ControlPanel](/endpoint/disabling_controlpanel/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Disabling Firewall with Netsh](/endpoint/disabling_firewall_with_netsh/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Disabling FolderOptions Windows Feature](/endpoint/disabling_folderoptions_windows_feature/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Disabling Net User Account](/endpoint/disabling_net_user_account/) | [Account Access Removal](/tags/#account-access-removal) | TTP | +| [Disabling NoRun Windows App](/endpoint/disabling_norun_windows_app/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | +| [Disabling SystemRestore In Registry](/endpoint/disabling_systemrestore_in_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Disabling Task Manager](/endpoint/disabling_task_manager/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Domain Account Discovery With Net App](/endpoint/domain_account_discovery_with_net_app/) | [Domain Account](/tags/#domain-account) | TTP | +| [Domain Account Discovery with Dsquery](/endpoint/domain_account_discovery_with_dsquery/) | [Domain Account](/tags/#domain-account) | Hunting | +| [Domain Account Discovery with Wmic](/endpoint/domain_account_discovery_with_wmic/) | [Domain Account](/tags/#domain-account) | TTP | +| [Domain Controller Discovery with Nltest](/endpoint/domain_controller_discovery_with_nltest/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | +| [Domain Controller Discovery with Wmic](/endpoint/domain_controller_discovery_with_wmic/) | [Remote System Discovery](/tags/#remote-system-discovery) | Hunting | +| [Domain Group Discovery With Dsquery](/endpoint/domain_group_discovery_with_dsquery/) | [Domain Groups](/tags/#domain-groups) | Hunting | +| [Domain Group Discovery With Net](/endpoint/domain_group_discovery_with_net/) | [Domain Groups](/tags/#domain-groups) | Hunting | +| [Domain Group Discovery With Wmic](/endpoint/domain_group_discovery_with_wmic/) | [Domain Groups](/tags/#domain-groups) | Hunting | +| [Domain Group Discovery with Adsisearcher](/endpoint/domain_group_discovery_with_adsisearcher/) | [Domain Groups](/tags/#domain-groups) | TTP | +| [Download Files Using Telegram](/endpoint/download_files_using_telegram/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | +| [Drop IcedID License dat](/endpoint/drop_icedid_license_dat/) | [Malicious File](/tags/#malicious-file) | Hunting | +| [Dump LSASS via comsvcs DLL](/endpoint/dump_lsass_via_comsvcs_dll/) | [LSASS Memory](/tags/#lsass-memory) | TTP | +| [Dump LSASS via procdump](/endpoint/dump_lsass_via_procdump/) | [LSASS Memory](/tags/#lsass-memory) | TTP | +| [Elevated Group Discovery With Net](/endpoint/elevated_group_discovery_with_net/) | [Domain Groups](/tags/#domain-groups) | TTP | +| [Elevated Group Discovery With Wmic](/endpoint/elevated_group_discovery_with_wmic/) | [Domain Groups](/tags/#domain-groups) | TTP | +| [Elevated Group Discovery with PowerView](/endpoint/elevated_group_discovery_with_powerview/) | [Domain Groups](/tags/#domain-groups) | Hunting | +| [Email Attachments With Lots Of Spaces]() | None | Anomaly | +| [Email files written outside of the Outlook directory](/application/email_files_written_outside_of_the_outlook_directory/) | [Local Email Collection](/tags/#local-email-collection) | TTP | +| [Email servers sending high volume traffic to hosts](/application/email_servers_sending_high_volume_traffic_to_hosts/) | [Remote Email Collection](/tags/#remote-email-collection) | Anomaly | +| [Enable RDP In Other Port Number](/endpoint/enable_rdp_in_other_port_number/) | [Remote Services](/tags/#remote-services) | TTP | +| [Enumerate Users Local Group Using Telegram](/endpoint/enumerate_users_local_group_using_telegram/) | [Account Discovery](/tags/#account-discovery) | TTP | +| [Esentutl SAM Copy](/endpoint/esentutl_sam_copy/) | [Security Account Manager](/tags/#security-account-manager) | Hunting | +| [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | +| [Excel Spawning PowerShell](/endpoint/excel_spawning_powershell/) | [Security Account Manager](/tags/#security-account-manager) | TTP | +| [Excel Spawning Windows Script Host](/endpoint/excel_spawning_windows_script_host/) | [Security Account Manager](/tags/#security-account-manager) | TTP | +| [Excessive Attempt To Disable Services](/endpoint/excessive_attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | Anomaly | +| [Excessive DNS Failures](/network/excessive_dns_failures/) | [DNS](/tags/#dns) | Anomaly | +| [Excessive Service Stop Attempt](/endpoint/excessive_service_stop_attempt/) | [Service Stop](/tags/#service-stop) | Anomaly | +| [Excessive Usage Of Cacls App](/endpoint/excessive_usage_of_cacls_app/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | Anomaly | +| [Excessive Usage Of Net App](/endpoint/excessive_usage_of_net_app/) | [Account Access Removal](/tags/#account-access-removal) | Anomaly | +| [Excessive Usage Of SC Service Utility](/endpoint/excessive_usage_of_sc_service_utility/) | [Service Execution](/tags/#service-execution) | Anomaly | +| [Excessive Usage Of Taskkill](/endpoint/excessive_usage_of_taskkill/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | Anomaly | +| [Excessive Usage of NSLOOKUP App](/endpoint/excessive_usage_of_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly | +| [Excessive number of distinct processes created in Windows Temp folder](/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | Anomaly | +| [Excessive number of service control start as disabled](/endpoint/excessive_number_of_service_control_start_as_disabled/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | Anomaly | +| [Excessive number of taskhost processes](/endpoint/excessive_number_of_taskhost_processes/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Anomaly | +| [Exchange PowerShell Abuse via SSRF](/endpoint/exchange_powershell_abuse_via_ssrf/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | +| [Exchange PowerShell Module Usage](/endpoint/exchange_powershell_module_usage/) | [PowerShell](/tags/#powershell) | TTP | +| [Executables Or Script Creation In Suspicious Path](/endpoint/executables_or_script_creation_in_suspicious_path/) | [Masquerading](/tags/#masquerading) | TTP | +| [Execute Javascript With Jscript COM CLSID](/endpoint/execute_javascript_with_jscript_com_clsid/) | [Visual Basic](/tags/#visual-basic) | TTP | +| [Execution of File with Multiple Extensions](/endpoint/execution_of_file_with_multiple_extensions/) | [Rename System Utilities](/tags/#rename-system-utilities) | TTP | +| [Extraction of Registry Hives](/endpoint/extraction_of_registry_hives/) | [Security Account Manager](/tags/#security-account-manager) | TTP | +| [File with Samsam Extension]() | None | TTP | +| [First Time Seen Child Process of Zoom](/endpoint/first_time_seen_child_process_of_zoom/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | Anomaly | +| [First Time Seen Running Windows Service](/endpoint/first_time_seen_running_windows_service/) | [Service Execution](/tags/#service-execution) | Anomaly | +| [First time seen command line argument](/endpoint/first_time_seen_command_line_argument/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution) | Anomaly | +| [FodHelper UAC Bypass](/endpoint/fodhelper_uac_bypass/) | [Modify Registry](/tags/#modify-registry), [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | +| [Fsutil Zeroing File](/endpoint/fsutil_zeroing_file/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | +| [GCP Detect gcploit framework](/cloud/gcp_detect_gcploit_framework/) | [Valid Accounts](/tags/#valid-accounts) | TTP | +| [GCP Kubernetes cluster pod scan detection](/cloud/gcp_kubernetes_cluster_pod_scan_detection/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | Hunting | +| [GPUpdate with no Command Line Arguments with Network](/endpoint/gpupdate_with_no_command_line_arguments_with_network/) | [Process Injection](/tags/#process-injection) | TTP | +| [GSuite Email Suspicious Attachment](/cloud/gsuite_email_suspicious_attachment/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | Anomaly | +| [Get ADDefaultDomainPasswordPolicy with Powershell](/endpoint/get_addefaultdomainpasswordpolicy_with_powershell/) | [Password Policy Discovery](/tags/#password-policy-discovery) | Hunting | +| [Get ADDefaultDomainPasswordPolicy with Powershell Script Block](/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block/) | [Password Policy Discovery](/tags/#password-policy-discovery) | Hunting | +| [Get ADUser with PowerShell](/endpoint/get_aduser_with_powershell/) | [Domain Account](/tags/#domain-account) | Hunting | +| [Get ADUser with PowerShell Script Block](/endpoint/get_aduser_with_powershell_script_block/) | [Domain Account](/tags/#domain-account) | Hunting | +| [Get ADUserResultantPasswordPolicy with Powershell](/endpoint/get_aduserresultantpasswordpolicy_with_powershell/) | [Password Policy Discovery](/tags/#password-policy-discovery) | TTP | +| [Get ADUserResultantPasswordPolicy with Powershell Script Block](/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block/) | [Password Policy Discovery](/tags/#password-policy-discovery) | TTP | +| [Get DomainPolicy with Powershell](/endpoint/get_domainpolicy_with_powershell/) | [Password Policy Discovery](/tags/#password-policy-discovery) | TTP | +| [Get DomainPolicy with Powershell Script Block](/endpoint/get_domainpolicy_with_powershell_script_block/) | [Password Policy Discovery](/tags/#password-policy-discovery) | TTP | +| [Get DomainUser with PowerShell](/endpoint/get_domainuser_with_powershell/) | [Domain Account](/tags/#domain-account) | TTP | +| [Get DomainUser with PowerShell Script Block](/endpoint/get_domainuser_with_powershell_script_block/) | [Domain Account](/tags/#domain-account) | TTP | +| [Get WMIObject Group Discovery](/endpoint/get_wmiobject_group_discovery/) | [Local Groups](/tags/#local-groups) | Hunting | +| [Get WMIObject Group Discovery with Script Block Logging](/endpoint/get_wmiobject_group_discovery_with_script_block_logging/) | [Local Groups](/tags/#local-groups) | Hunting | +| [Get-DomainTrust with PowerShell](/endpoint/get-domaintrust_with_powershell/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | +| [Get-DomainTrust with PowerShell Script Block](/endpoint/get-domaintrust_with_powershell_script_block/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | +| [Get-ForestTrust with PowerShell](/endpoint/get-foresttrust_with_powershell/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | +| [Get-ForestTrust with PowerShell Script Block](/endpoint/get-foresttrust_with_powershell_script_block/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | +| [GetAdComputer with PowerShell](/endpoint/getadcomputer_with_powershell/) | [Remote System Discovery](/tags/#remote-system-discovery) | Hunting | +| [GetAdComputer with PowerShell Script Block](/endpoint/getadcomputer_with_powershell_script_block/) | [Remote System Discovery](/tags/#remote-system-discovery) | Hunting | +| [GetAdGroup with PowerShell](/endpoint/getadgroup_with_powershell/) | [Domain Groups](/tags/#domain-groups) | Hunting | +| [GetAdGroup with PowerShell Script Block](/endpoint/getadgroup_with_powershell_script_block/) | [Domain Groups](/tags/#domain-groups) | Hunting | +| [GetCurrent User with PowerShell](/endpoint/getcurrent_user_with_powershell/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Hunting | +| [GetCurrent User with PowerShell Script Block](/endpoint/getcurrent_user_with_powershell_script_block/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Hunting | +| [GetDomainComputer with PowerShell](/endpoint/getdomaincomputer_with_powershell/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | +| [GetDomainComputer with PowerShell Script Block](/endpoint/getdomaincomputer_with_powershell_script_block/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | +| [GetDomainController with PowerShell](/endpoint/getdomaincontroller_with_powershell/) | [Remote System Discovery](/tags/#remote-system-discovery) | Hunting | +| [GetDomainController with PowerShell Script Block](/endpoint/getdomaincontroller_with_powershell_script_block/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | +| [GetDomainGroup with PowerShell](/endpoint/getdomaingroup_with_powershell/) | [Domain Groups](/tags/#domain-groups) | TTP | +| [GetDomainGroup with PowerShell Script Block](/endpoint/getdomaingroup_with_powershell_script_block/) | [Domain Groups](/tags/#domain-groups) | TTP | +| [GetLocalUser with PowerShell](/endpoint/getlocaluser_with_powershell/) | [Local Account](/tags/#local-account) | Hunting | +| [GetLocalUser with PowerShell Script Block](/endpoint/getlocaluser_with_powershell_script_block/) | [Local Account](/tags/#local-account) | Hunting | +| [GetNetTcpconnection with PowerShell](/endpoint/getnettcpconnection_with_powershell/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | Hunting | +| [GetNetTcpconnection with PowerShell Script Block](/endpoint/getnettcpconnection_with_powershell_script_block/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | Hunting | +| [GetWmiObject DS User with PowerShell](/endpoint/getwmiobject_ds_user_with_powershell/) | [Domain Account](/tags/#domain-account) | TTP | +| [GetWmiObject DS User with PowerShell Script Block](/endpoint/getwmiobject_ds_user_with_powershell_script_block/) | [Domain Account](/tags/#domain-account) | TTP | +| [GetWmiObject Ds Computer with PowerShell](/endpoint/getwmiobject_ds_computer_with_powershell/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | +| [GetWmiObject Ds Computer with PowerShell Script Block](/endpoint/getwmiobject_ds_computer_with_powershell_script_block/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | +| [GetWmiObject Ds Group with PowerShell](/endpoint/getwmiobject_ds_group_with_powershell/) | [Domain Groups](/tags/#domain-groups) | TTP | +| [GetWmiObject Ds Group with PowerShell Script Block](/endpoint/getwmiobject_ds_group_with_powershell_script_block/) | [Domain Groups](/tags/#domain-groups) | TTP | +| [GetWmiObject User Account with PowerShell](/endpoint/getwmiobject_user_account_with_powershell/) | [Local Account](/tags/#local-account) | Hunting | +| [GetWmiObject User Account with PowerShell Script Block](/endpoint/getwmiobject_user_account_with_powershell_script_block/) | [Local Account](/tags/#local-account) | Hunting | +| [GitHub Dependabot Alert](/cloud/github_dependabot_alert/) | [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools) | Anomaly | +| [GitHub Pull Request from Unknown User](/cloud/github_pull_request_from_unknown_user/) | [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools) | Anomaly | +| [Github Commit Changes In Master](/cloud/github_commit_changes_in_master/) | [Trusted Relationship](/tags/#trusted-relationship) | Anomaly | +| [Github Commit In Develop](/cloud/github_commit_in_develop/) | [Trusted Relationship](/tags/#trusted-relationship) | Anomaly | +| [Grant Permission Using Cacls Utility](/endpoint/grant_permission_using_cacls_utility/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP | +| [Gsuite Drive Share In External Email](/cloud/gsuite_drive_share_in_external_email/) | [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage) | Anomaly | +| [Gsuite Email Suspicious Subject With Attachment](/cloud/gsuite_email_suspicious_subject_with_attachment/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | Anomaly | +| [Gsuite Email With Known Abuse Web Service Link](/cloud/gsuite_email_with_known_abuse_web_service_link/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | Anomaly | +| [Gsuite Outbound Email With Attachment To External Domain](/cloud/gsuite_outbound_email_with_attachment_to_external_domain/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | Anomaly | +| [Gsuite Suspicious Shared File Name](/cloud/gsuite_suspicious_shared_file_name/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | Anomaly | +| [Hide User Account From Sign-In Screen](/endpoint/hide_user_account_from_sign-in_screen/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP | +| [High File Deletion Frequency](/endpoint/high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | Anomaly | +| [High Number of Login Failures from a single source](/cloud/high_number_of_login_failures_from_a_single_source/) | [Password Guessing](/tags/#password-guessing) | Anomaly | +| [High Process Termination Frequency](/endpoint/high_process_termination_frequency/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | Anomaly | +| [Hosts receiving high volume of network traffic from email server](/network/hosts_receiving_high_volume_of_network_traffic_from_email_server/) | [Remote Email Collection](/tags/#remote-email-collection) | Anomaly | +| [ICACLS Grant Command](/endpoint/icacls_grant_command/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP | +| [Icacls Deny Command](/endpoint/icacls_deny_command/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP | +| [IcedID Exfiltrated Archived File Creation](/endpoint/icedid_exfiltrated_archived_file_creation/) | [Archive via Utility](/tags/#archive-via-utility) | Hunting | +| [Illegal Access To User Content via PowerSploit modules](/endpoint/illegal_access_to_user_content_via_powersploit_modules/) | [Remote Services](/tags/#remote-services), [Screen Capture](/tags/#screen-capture), [Audio Capture](/tags/#audio-capture), [Remote Service Session Hijacking](/tags/#remote-service-session-hijacking) | TTP | +| [Illegal Account Creation via PowerSploit modules](/endpoint/illegal_account_creation_via_powersploit_modules/) | [Establish Accounts](/tags/#establish-accounts) | TTP | +| [Illegal Deletion of Logs via Mimikatz modules](/endpoint/illegal_deletion_of_logs_via_mimikatz_modules/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | +| [Illegal Enabling or Disabling of Accounts via DSInternals modules](/endpoint/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP | +| [Illegal Management of Active Directory Elements and Policies via DSInternals modules](/endpoint/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules/) | [Account Manipulation](/tags/#account-manipulation), [Rogue Domain Controller](/tags/#rogue-domain-controller), [Domain Policy Modification](/tags/#domain-policy-modification) | TTP | +| [Illegal Management of Computers and Active Directory Elements via PowerSploit modules](/endpoint/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules/) | [Account Manipulation](/tags/#account-manipulation), [Rogue Domain Controller](/tags/#rogue-domain-controller), [Domain Policy Modification](/tags/#domain-policy-modification) | TTP | +| [Illegal Privilege Elevation and Persistence via PowerSploit modules](/endpoint/illegal_privilege_elevation_and_persistence_via_powersploit_modules/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [Illegal Privilege Elevation via Mimikatz modules](/endpoint/illegal_privilege_elevation_via_mimikatz_modules/) | [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [Illegal Service and Process Control via Mimikatz modules](/endpoint/illegal_service_and_process_control_via_mimikatz_modules/) | [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services) | TTP | +| [Illegal Service and Process Control via PowerSploit modules](/endpoint/illegal_service_and_process_control_via_powersploit_modules/) | [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services) | TTP | +| [Jscript Execution Using Cscript App](/endpoint/jscript_execution_using_cscript_app/) | [JavaScript](/tags/#javascript) | TTP | +| [Kerberoasting spn request with RC4 encryption](/endpoint/kerberoasting_spn_request_with_rc4_encryption/) | [Kerberoasting](/tags/#kerberoasting) | TTP | +| [Known Services Killed by Ransomware](/endpoint/known_services_killed_by_ransomware/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | +| [Kubernetes AWS detect suspicious kubectl calls]() | None | Hunting | +| [Kubernetes Nginx Ingress LFI](/cloud/kubernetes_nginx_ingress_lfi/) | [Exploitation for Credential Access](/tags/#exploitation-for-credential-access) | TTP | +| [Kubernetes Nginx Ingress RFI](/cloud/kubernetes_nginx_ingress_rfi/) | [Exploitation for Credential Access](/tags/#exploitation-for-credential-access) | TTP | +| [Kubernetes Scanner Image Pulling](/cloud/kubernetes_scanner_image_pulling/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | TTP | +| [Large Volume of DNS ANY Queries](/network/large_volume_of_dns_any_queries/) | [Reflection Amplification](/tags/#reflection-amplification) | Anomaly | +| [Local Account Discovery With Wmic](/endpoint/local_account_discovery_with_wmic/) | [Local Account](/tags/#local-account) | Hunting | +| [Local Account Discovery with Net](/endpoint/local_account_discovery_with_net/) | [Local Account](/tags/#local-account) | Hunting | +| [MS Scripting Process Loading Ldap Module](/endpoint/ms_scripting_process_loading_ldap_module/) | [JavaScript](/tags/#javascript) | Anomaly | +| [MS Scripting Process Loading WMI Module](/endpoint/ms_scripting_process_loading_wmi_module/) | [JavaScript](/tags/#javascript) | Anomaly | +| [MSHTML Module Load in Office Product](/endpoint/mshtml_module_load_in_office_product/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [MacOS - Re-opened Applications]() | None | TTP | +| [Mailsniper Invoke functions](/endpoint/mailsniper_invoke_functions/) | [Local Email Collection](/tags/#local-email-collection) | TTP | +| [Malicious PowerShell Process - Connect To Internet With Hidden Window](/endpoint/malicious_powershell_process_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell) | Hunting | +| [Malicious PowerShell Process - Encoded Command](/endpoint/malicious_powershell_process_-_encoded_command/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information) | Hunting | +| [Malicious PowerShell Process - Execution Policy Bypass](/endpoint/malicious_powershell_process_-_execution_policy_bypass/) | [PowerShell](/tags/#powershell) | TTP | +| [Malicious PowerShell Process With Obfuscation Techniques](/endpoint/malicious_powershell_process_with_obfuscation_techniques/) | [PowerShell](/tags/#powershell) | TTP | +| [Malicious Powershell Executed As A Service](/endpoint/malicious_powershell_executed_as_a_service/) | [Service Execution](/tags/#service-execution) | TTP | +| [Modification Of Wallpaper](/endpoint/modification_of_wallpaper/) | [Defacement](/tags/#defacement) | TTP | +| [Modify ACL permission To Files Or Folder](/endpoint/modify_acl_permission_to_files_or_folder/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP | +| [Modify ACLs Permission Of Files Or Folders](/endpoint/modify_acls_permission_of_files_or_folders/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | Anomaly | +| [Monitor Email For Brand Abuse]() | None | TTP | +| [Monitor Registry Keys for Print Monitors](/endpoint/monitor_registry_keys_for_print_monitors/) | [Port Monitors](/tags/#port-monitors) | TTP | +| [Monitor Web Traffic For Brand Abuse]() | None | TTP | +| [More than usual number of LOLBAS applications in short time period](/endpoint/more_than_usual_number_of_lolbas_applications_in_short_time_period/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly | +| [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [Mshta](/tags/#mshta) | TTP | +| [Msmpeng Application DLL Side Loading](/endpoint/msmpeng_application_dll_side_loading/) | [DLL Side-Loading](/tags/#dll-side-loading) | TTP | +| [Multiple Archive Files Http Post Traffic](/network/multiple_archive_files_http_post_traffic/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | TTP | +| [Multiple Disabled Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying) | Anomaly | +| [Multiple Invalid Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying) | Anomaly | +| [Multiple Invalid Users Failing To Authenticate From Host Using NTLM](/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm/) | [Password Spraying](/tags/#password-spraying) | Anomaly | +| [Multiple Okta Users With Invalid Credentials From The Same IP](/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip/) | [Default Accounts](/tags/#default-accounts) | TTP | +| [Multiple Users Attempting To Authenticate Using Explicit Credentials](/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials/) | [Password Spraying](/tags/#password-spraying) | Anomaly | +| [Multiple Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying) | Anomaly | +| [Multiple Users Failing To Authenticate From Host Using NTLM](/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm/) | [Password Spraying](/tags/#password-spraying) | Anomaly | +| [Multiple Users Failing To Authenticate From Process](/endpoint/multiple_users_failing_to_authenticate_from_process/) | [Password Spraying](/tags/#password-spraying) | Anomaly | +| [Multiple Users Remotely Failing To Authenticate From Host](/endpoint/multiple_users_remotely_failing_to_authenticate_from_host/) | [Password Spraying](/tags/#password-spraying) | Anomaly | +| [NET Profiler UAC bypass](/endpoint/net_profiler_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | +| [NLTest Domain Trust Discovery](/endpoint/nltest_domain_trust_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | +| [Net Localgroup Discovery](/endpoint/net_localgroup_discovery/) | [Local Groups](/tags/#local-groups) | Hunting | +| [Network Connection Discovery With Arp](/endpoint/network_connection_discovery_with_arp/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | Hunting | +| [Network Connection Discovery With Net](/endpoint/network_connection_discovery_with_net/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | Hunting | +| [Network Connection Discovery With Netstat](/endpoint/network_connection_discovery_with_netstat/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | Hunting | +| [New container uploaded to AWS ECR](/cloud/new_container_uploaded_to_aws_ecr/) | [Implant Internal Image](/tags/#implant-internal-image) | Hunting | +| [Nishang PowershellTCPOneLine](/endpoint/nishang_powershelltcponeline/) | [PowerShell](/tags/#powershell) | TTP | +| [No Windows Updates in a time frame]() | None | Hunting | +| [Non Chrome Process Accessing Chrome Default Dir](/endpoint/non_chrome_process_accessing_chrome_default_dir/) | [Credentials from Web Browsers](/tags/#credentials-from-web-browsers) | Anomaly | +| [Non Firefox Process Access Firefox Profile Dir](/endpoint/non_firefox_process_access_firefox_profile_dir/) | [Credentials from Web Browsers](/tags/#credentials-from-web-browsers) | Anomaly | +| [Ntdsutil Export NTDS](/endpoint/ntdsutil_export_ntds/) | [NTDS](/tags/#ntds) | TTP | +| [O365 Add App Role Assignment Grant User](/cloud/o365_add_app_role_assignment_grant_user/) | [Cloud Account](/tags/#cloud-account) | TTP | +| [O365 Added Service Principal](/cloud/o365_added_service_principal/) | [Cloud Account](/tags/#cloud-account) | TTP | +| [O365 Bypass MFA via Trusted IP](/cloud/o365_bypass_mfa_via_trusted_ip/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | TTP | +| [O365 Disable MFA](/cloud/o365_disable_mfa/) | [Modify Authentication Process](/tags/#modify-authentication-process) | TTP | +| [O365 Excessive Authentication Failures Alert](/cloud/o365_excessive_authentication_failures_alert/) | [Brute Force](/tags/#brute-force) | Anomaly | +| [O365 Excessive SSO logon errors](/cloud/o365_excessive_sso_logon_errors/) | [Modify Authentication Process](/tags/#modify-authentication-process) | Anomaly | +| [O365 New Federated Domain Added](/cloud/o365_new_federated_domain_added/) | [Cloud Account](/tags/#cloud-account) | TTP | +| [O365 PST export alert](/cloud/o365_pst_export_alert/) | [Email Collection](/tags/#email-collection) | TTP | +| [O365 Suspicious Admin Email Forwarding](/cloud/o365_suspicious_admin_email_forwarding/) | [Email Forwarding Rule](/tags/#email-forwarding-rule) | Anomaly | +| [O365 Suspicious Rights Delegation](/cloud/o365_suspicious_rights_delegation/) | [Remote Email Collection](/tags/#remote-email-collection) | TTP | +| [O365 Suspicious User Email Forwarding](/cloud/o365_suspicious_user_email_forwarding/) | [Email Forwarding Rule](/tags/#email-forwarding-rule) | Anomaly | +| [Office Application Drop Executable](/endpoint/office_application_drop_executable/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Application Spawn Regsvr32 process](/endpoint/office_application_spawn_regsvr32_process/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Application Spawn rundll32 process](/endpoint/office_application_spawn_rundll32_process/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Document Creating Schedule Task](/endpoint/office_document_creating_schedule_task/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Document Executing Macro Code](/endpoint/office_document_executing_macro_code/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Document Spawned Child Process To Download](/endpoint/office_document_spawned_child_process_to_download/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Product Spawn CMD Process](/endpoint/office_product_spawn_cmd_process/) | [Mshta](/tags/#mshta) | TTP | +| [Office Product Spawning BITSAdmin](/endpoint/office_product_spawning_bitsadmin/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Product Spawning CertUtil](/endpoint/office_product_spawning_certutil/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Product Spawning MSHTA](/endpoint/office_product_spawning_mshta/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Product Spawning Rundll32 with no DLL](/endpoint/office_product_spawning_rundll32_with_no_dll/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Product Spawning Wmic](/endpoint/office_product_spawning_wmic/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Product Writing cab or inf](/endpoint/office_product_writing_cab_or_inf/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Office Spawning Control](/endpoint/office_spawning_control/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Okta Account Lockout Events](/application/okta_account_lockout_events/) | [Default Accounts](/tags/#default-accounts) | Anomaly | +| [Okta Failed SSO Attempts](/application/okta_failed_sso_attempts/) | [Default Accounts](/tags/#default-accounts) | Anomaly | +| [Okta User Logins From Multiple Cities](/application/okta_user_logins_from_multiple_cities/) | [Default Accounts](/tags/#default-accounts) | Anomaly | +| [Overwriting Accessibility Binaries](/endpoint/overwriting_accessibility_binaries/) | [Accessibility Features](/tags/#accessibility-features) | TTP | +| [Password Policy Discovery with Net](/endpoint/password_policy_discovery_with_net/) | [Password Policy Discovery](/tags/#password-policy-discovery) | Hunting | +| [Permission Modification using Takeown App](/endpoint/permission_modification_using_takeown_app/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP | +| [PetitPotam Network Share Access Request](/endpoint/petitpotam_network_share_access_request/) | [Forced Authentication](/tags/#forced-authentication) | TTP | +| [PetitPotam Suspicious Kerberos TGT Request](/endpoint/petitpotam_suspicious_kerberos_tgt_request/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [Phishing Email Detection by Machine Learning Method - SSA](/application/phishing_email_detection_by_machine_learning_method_-_ssa/) | [Phishing](/tags/#phishing) | Anomaly | +| [Plain HTTP POST Exfiltrated Data](/network/plain_http_post_exfiltrated_data/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | TTP | +| [Potential Pass the Token or Hash Observed at the Destination Device](/endpoint/potential_pass_the_token_or_hash_observed_at_the_destination_device/) | [Pass the Hash](/tags/#pass-the-hash) | TTP | +| [Potential Pass the Token or Hash Observed by an Event Collecting Device](/endpoint/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device/) | [Pass the Hash](/tags/#pass-the-hash) | TTP | +| [PowerShell 4104 Hunting](/endpoint/powershell_4104_hunting/) | [PowerShell](/tags/#powershell) | Hunting | +| [PowerShell Domain Enumeration](/endpoint/powershell_domain_enumeration/) | [PowerShell](/tags/#powershell) | TTP | +| [PowerShell Get LocalGroup Discovery](/endpoint/powershell_get_localgroup_discovery/) | [Local Groups](/tags/#local-groups) | Hunting | +| [PowerShell Loading DotNET into Memory via System Reflection Assembly](/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly/) | [PowerShell](/tags/#powershell) | TTP | +| [PowerShell Start-BitsTransfer](/endpoint/powershell_start-bitstransfer/) | [BITS Jobs](/tags/#bits-jobs) | TTP | +| [Powershell Creating Thread Mutex](/endpoint/powershell_creating_thread_mutex/) | [Indicator Removal from Tools](/tags/#indicator-removal-from-tools) | TTP | +| [Powershell Disable Security Monitoring](/endpoint/powershell_disable_security_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Powershell Enable SMB1Protocol Feature](/endpoint/powershell_enable_smb1protocol_feature/) | [Indicator Removal from Tools](/tags/#indicator-removal-from-tools) | TTP | +| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking) | TTP | +| [Powershell Fileless Process Injection via GetProcAddress](/endpoint/powershell_fileless_process_injection_via_getprocaddress/) | [Process Injection](/tags/#process-injection), [PowerShell](/tags/#powershell) | TTP | +| [Powershell Fileless Script Contains Base64 Encoded Content](/endpoint/powershell_fileless_script_contains_base64_encoded_content/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [PowerShell](/tags/#powershell) | TTP | +| [Powershell Get LocalGroup Discovery with Script Block Logging](/endpoint/powershell_get_localgroup_discovery_with_script_block_logging/) | [Local Groups](/tags/#local-groups) | Hunting | +| [Powershell Processing Stream Of Data](/endpoint/powershell_processing_stream_of_data/) | [PowerShell](/tags/#powershell) | TTP | +| [Powershell Remote Thread To Known Windows Process](/endpoint/powershell_remote_thread_to_known_windows_process/) | [Process Injection](/tags/#process-injection) | TTP | +| [Powershell Using memory As Backing Store](/endpoint/powershell_using_memory_as_backing_store/) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information) | TTP | +| [Prevent Automatic Repair Mode using Bcdedit](/endpoint/prevent_automatic_repair_mode_using_bcdedit/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | +| [Print Spooler Adding A Printer Driver](/endpoint/print_spooler_adding_a_printer_driver/) | [Print Processors](/tags/#print-processors) | TTP | +| [Print Spooler Failed to Load a Plug-in](/endpoint/print_spooler_failed_to_load_a_plug-in/) | [Print Processors](/tags/#print-processors) | TTP | +| [Probing Access with Stolen Credentials via PowerSploit modules](/endpoint/probing_access_with_stolen_credentials_via_powersploit_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP | +| [Process Creating LNK file in Suspicious Location](/endpoint/process_creating_lnk_file_in_suspicious_location/) | [Spearphishing Link](/tags/#spearphishing-link) | TTP | +| [Process Deleting Its Process File Path](/endpoint/process_deleting_its_process_file_path/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | +| [Process Execution via WMI](/endpoint/process_execution_via_wmi/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP | +| [Process Kill Base On File Path](/endpoint/process_kill_base_on_file_path/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Processes Tapping Keyboard Events]() | None | TTP | +| [Processes launching netsh](/endpoint/processes_launching_netsh/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall) | TTP | +| [Prohibited Network Traffic Allowed](/network/prohibited_network_traffic_allowed/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP | +| [Protocol or Port Mismatch](/network/protocol_or_port_mismatch/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | Anomaly | +| [Protocols passing authentication in cleartext]() | None | TTP | +| [Ransomware Notes bulk creation](/endpoint/ransomware_notes_bulk_creation/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | Anomaly | +| [Rare Parent-Child Process Relationship](/endpoint/rare_parent-child_process_relationship/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Scheduled Task/Job](/tags/#scheduled-task/job), [Software Deployment Tools](/tags/#software-deployment-tools) | Anomaly | +| [Recon AVProduct Through Pwh or WMI](/endpoint/recon_avproduct_through_pwh_or_wmi/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | TTP | +| [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | TTP | +| [Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules](/endpoint/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Discovery](/tags/#account-discovery), [Domain Policy Modification](/tags/#domain-policy-modification) | TTP | +| [Reconnaissance and Access to Accounts and Groups via Mimikatz modules](/endpoint/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Discovery](/tags/#account-discovery), [Domain Policy Modification](/tags/#domain-policy-modification) | TTP | +| [Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit modules](/endpoint/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules/) | [Trusted Relationship](/tags/#trusted-relationship), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Gather Victim Org Information](/tags/#gather-victim-org-information), [Active Scanning](/tags/#active-scanning) | TTP | +| [Reconnaissance and Access to Computers and Domains via PowerSploit modules](/endpoint/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules/) | [Gather Victim Host Information](/tags/#gather-victim-host-information), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Account Discovery](/tags/#account-discovery) | TTP | +| [Reconnaissance and Access to Computers via Mimikatz modules](/endpoint/reconnaissance_and_access_to_computers_via_mimikatz_modules/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | TTP | +| [Reconnaissance and Access to Operating System Elements via PowerSploit modules](/endpoint/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules/) | [System Service Discovery](/tags/#system-service-discovery), [Query Registry](/tags/#query-registry), [Network Service Scanning](/tags/#network-service-scanning), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Discovery](/tags/#process-discovery), [File and Directory Discovery](/tags/#file-and-directory-discovery), [Software Discovery](/tags/#software-discovery), [Software](/tags/#software) | TTP | +| [Reconnaissance and Access to Processes and Services via Mimikatz modules](/endpoint/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules/) | [System Service Discovery](/tags/#system-service-discovery), [Network Service Scanning](/tags/#network-service-scanning), [Process Discovery](/tags/#process-discovery) | TTP | +| [Reconnaissance and Access to Shared Resources via Mimikatz modules](/endpoint/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Network Share Discovery](/tags/#network-share-discovery), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive) | TTP | +| [Reconnaissance and Access to Shared Resources via PowerSploit modules](/endpoint/reconnaissance_and_access_to_shared_resources_via_powersploit_modules/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Network Share Discovery](/tags/#network-share-discovery), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive) | TTP | +| [Reconnaissance of Access and Persistence Opportunities via PowerSploit modules](/endpoint/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP | +| [Reconnaissance of Connectivity via PowerSploit modules](/endpoint/reconnaissance_of_connectivity_via_powersploit_modules/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Network Share Discovery](/tags/#network-share-discovery), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive) | TTP | +| [Reconnaissance of Credential Stores and Services via Mimikatz modules](/endpoint/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules/) | [Credentials](/tags/#credentials), [Domain Properties](/tags/#domain-properties), [Network Trust Dependencies](/tags/#network-trust-dependencies), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP | +| [Reconnaissance of Defensive Tools via PowerSploit modules](/endpoint/reconnaissance_of_defensive_tools_via_powersploit_modules/) | [Vulnerability Scanning](/tags/#vulnerability-scanning), [Software](/tags/#software) | TTP | +| [Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules](/endpoint/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP | +| [Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules](/endpoint/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Process Injection](/tags/#process-injection), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP | +| [Recursive Delete of Directory In Batch CMD](/endpoint/recursive_delete_of_directory_in_batch_cmd/) | [File Deletion](/tags/#file-deletion) | TTP | +| [Reg exe Manipulating Windows Services Registry Keys](/endpoint/reg_exe_manipulating_windows_services_registry_keys/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | TTP | +| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | TTP | +| [Registry Keys Used For Privilege Escalation](/endpoint/registry_keys_used_for_privilege_escalation/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | TTP | +| [Registry Keys for Creating SHIM Databases](/endpoint/registry_keys_for_creating_shim_databases/) | [Application Shimming](/tags/#application-shimming) | TTP | +| [Remcos RAT File Creation in Remcos Folder](/endpoint/remcos_rat_file_creation_in_remcos_folder/) | [Screen Capture](/tags/#screen-capture) | TTP | +| [Remcos client registry install entry](/endpoint/remcos_client_registry_install_entry/) | [Modify Registry](/tags/#modify-registry) | TTP | +| [Remote Desktop Network Bruteforce](/network/remote_desktop_network_bruteforce/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | TTP | +| [Remote Desktop Network Traffic](/network/remote_desktop_network_traffic/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | Anomaly | +| [Remote Desktop Process Running On System](/endpoint/remote_desktop_process_running_on_system/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | Hunting | +| [Remote Process Instantiation via WMI](/endpoint/remote_process_instantiation_via_wmi/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP | +| [Remote System Discovery with Adsisearcher](/endpoint/remote_system_discovery_with_adsisearcher/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | +| [Remote System Discovery with Dsquery](/endpoint/remote_system_discovery_with_dsquery/) | [Remote System Discovery](/tags/#remote-system-discovery) | Hunting | +| [Remote System Discovery with Net](/endpoint/remote_system_discovery_with_net/) | [Remote System Discovery](/tags/#remote-system-discovery) | Hunting | +| [Remote System Discovery with Wmic](/endpoint/remote_system_discovery_with_wmic/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | +| [Remote WMI Command Attempt](/endpoint/remote_wmi_command_attempt/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP | +| [Resize ShadowStorage volume](/endpoint/resize_shadowstorage_volume/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | +| [Resize Shadowstorage Volume](/endpoint/resize_shadowstorage_volume/) | [Service Stop](/tags/#service-stop) | TTP | +| [Revil Common Exec Parameter](/endpoint/revil_common_exec_parameter/) | [User Execution](/tags/#user-execution) | TTP | +| [Revil Registry Entry](/endpoint/revil_registry_entry/) | [Modify Registry](/tags/#modify-registry) | TTP | +| [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [Rundll32](/tags/#rundll32) | TTP | +| [Rundll32 Control RunDLL Hunt](/endpoint/rundll32_control_rundll_hunt/) | [Rundll32](/tags/#rundll32) | Hunting | +| [Rundll32 Control RunDLL World Writable Directory](/endpoint/rundll32_control_rundll_world_writable_directory/) | [Rundll32](/tags/#rundll32) | TTP | +| [Rundll32 Create Remote Thread To A Process](/endpoint/rundll32_create_remote_thread_to_a_process/) | [Process Injection](/tags/#process-injection) | TTP | +| [Rundll32 CreateRemoteThread In Browser](/endpoint/rundll32_createremotethread_in_browser/) | [Process Injection](/tags/#process-injection) | TTP | +| [Rundll32 DNSQuery](/endpoint/rundll32_dnsquery/) | [Rundll32](/tags/#rundll32) | TTP | +| [Rundll32 Process Creating Exe Dll Files](/endpoint/rundll32_process_creating_exe_dll_files/) | [Rundll32](/tags/#rundll32) | TTP | +| [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [Rundll32](/tags/#rundll32) | TTP | +| [Ryuk Test Files Detected](/endpoint/ryuk_test_files_detected/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | TTP | +| [Ryuk Wake on LAN Command](/endpoint/ryuk_wake_on_lan_command/) | [Windows Command Shell](/tags/#windows-command-shell) | TTP | +| [SAM Database File Access Attempt](/endpoint/sam_database_file_access_attempt/) | [Security Account Manager](/tags/#security-account-manager) | Hunting | +| [SLUI RunAs Elevated](/endpoint/slui_runas_elevated/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | +| [SLUI Spawning a Process](/endpoint/slui_spawning_a_process/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | +| [SMB Traffic Spike](/network/smb_traffic_spike/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | Anomaly | +| [SMB Traffic Spike - MLTK](/network/smb_traffic_spike_-_mltk/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | Anomaly | +| [SQL Injection with Long URLs](/web/sql_injection_with_long_urls/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | +| [Samsam Test File Write](/endpoint/samsam_test_file_write/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | TTP | +| [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service) | TTP | +| [SchCache Change By App Connect And Create ADSI Object](/endpoint/schcache_change_by_app_connect_and_create_adsi_object/) | [Domain Account](/tags/#domain-account) | Anomaly | +| [Schedule Task with HTTP Command Arguments](/endpoint/schedule_task_with_http_command_arguments/) | [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | +| [Schedule Task with Rundll32 Command Trigger](/endpoint/schedule_task_with_rundll32_command_trigger/) | [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | +| [Scheduled Task Deleted Or Created via CMD](/endpoint/scheduled_task_deleted_or_created_via_cmd/) | [Scheduled Task](/tags/#scheduled-task) | TTP | +| [Schtasks Run Task On Demand](/endpoint/schtasks_run_task_on_demand/) | [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP | +| [Schtasks scheduling job on remote system](/endpoint/schtasks_scheduling_job_on_remote_system/) | [Scheduled Task](/tags/#scheduled-task) | TTP | +| [Schtasks used for forcing a reboot](/endpoint/schtasks_used_for_forcing_a_reboot/) | [Scheduled Task](/tags/#scheduled-task) | TTP | +| [Script Execution via WMI](/endpoint/script_execution_via_wmi/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP | +| [Sdclt UAC Bypass](/endpoint/sdclt_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | +| [SearchProtocolHost with no Command Line with Network](/endpoint/searchprotocolhost_with_no_command_line_with_network/) | [Process Injection](/tags/#process-injection) | TTP | +| [SecretDumps Offline NTDS Dumping Tool](/endpoint/secretdumps_offline_ntds_dumping_tool/) | [NTDS](/tags/#ntds) | TTP | +| [Services Escalate Exe](/endpoint/services_escalate_exe/) | [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | +| [Set Default PowerShell Execution Policy To Unrestricted or Bypass](/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass/) | [PowerShell](/tags/#powershell) | TTP | +| [Setting Credentials via DSInternals modules](/endpoint/setting_credentials_via_dsinternals_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP | +| [Setting Credentials via Mimikatz modules](/endpoint/setting_credentials_via_mimikatz_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP | +| [Setting Credentials via PowerSploit modules](/endpoint/setting_credentials_via_powersploit_modules/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP | +| [Shim Database File Creation](/endpoint/shim_database_file_creation/) | [Application Shimming](/tags/#application-shimming) | TTP | +| [Shim Database Installation With Suspicious Parameters](/endpoint/shim_database_installation_with_suspicious_parameters/) | [Application Shimming](/tags/#application-shimming) | TTP | +| [Short Lived Windows Accounts](/endpoint/short_lived_windows_accounts/) | [Local Account](/tags/#local-account) | TTP | +| [SilentCleanup UAC Bypass](/endpoint/silentcleanup_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | +| [Single Letter Process On Endpoint](/endpoint/single_letter_process_on_endpoint/) | [Malicious File](/tags/#malicious-file) | TTP | +| [Spike in File Writes]() | None | Anomaly | +| [Spoolsv Spawning Rundll32](/endpoint/spoolsv_spawning_rundll32/) | [Print Processors](/tags/#print-processors) | TTP | +| [Spoolsv Suspicious Loaded Modules](/endpoint/spoolsv_suspicious_loaded_modules/) | [Print Processors](/tags/#print-processors) | TTP | +| [Spoolsv Suspicious Process Access](/endpoint/spoolsv_suspicious_process_access/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | TTP | +| [Spoolsv Writing a DLL](/endpoint/spoolsv_writing_a_dll/) | [Print Processors](/tags/#print-processors) | TTP | +| [Spoolsv Writing a DLL - Sysmon](/endpoint/spoolsv_writing_a_dll_-_sysmon/) | [Print Processors](/tags/#print-processors) | TTP | +| [Sqlite Module In Temp Folder](/endpoint/sqlite_module_in_temp_folder/) | [Data from Local System](/tags/#data-from-local-system) | TTP | +| [Start Up During Safe Mode Boot](/endpoint/start_up_during_safe_mode_boot/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | TTP | +| [Sunburst Correlation DLL and Network Event](/endpoint/sunburst_correlation_dll_and_network_event/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | TTP | +| [Supernova Webshell](/web/supernova_webshell/) | [Web Shell](/tags/#web-shell) | TTP | +| [Suspicious Curl Network Connection](/endpoint/suspicious_curl_network_connection/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | +| [Suspicious DLLHost no Command Line Arguments](/endpoint/suspicious_dllhost_no_command_line_arguments/) | [Process Injection](/tags/#process-injection) | TTP | +| [Suspicious Driver Loaded Path](/endpoint/suspicious_driver_loaded_path/) | [Windows Service](/tags/#windows-service) | TTP | +| [Suspicious Email Attachment Extensions](/application/suspicious_email_attachment_extensions/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | Anomaly | +| [Suspicious Event Log Service Behavior](/endpoint/suspicious_event_log_service_behavior/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Suspicious GPUpdate no Command Line Arguments](/endpoint/suspicious_gpupdate_no_command_line_arguments/) | [Process Injection](/tags/#process-injection) | TTP | +| [Suspicious IcedID Regsvr32 Cmdline](/endpoint/suspicious_icedid_regsvr32_cmdline/) | [Regsvr32](/tags/#regsvr32) | TTP | +| [Suspicious IcedID Rundll32 Cmdline](/endpoint/suspicious_icedid_rundll32_cmdline/) | [Rundll32](/tags/#rundll32) | TTP | +| [Suspicious Image Creation In Appdata Folder](/endpoint/suspicious_image_creation_in_appdata_folder/) | [Screen Capture](/tags/#screen-capture) | TTP | +| [Suspicious Java Classes]() | None | Anomaly | +| [Suspicious MSBuild Rename](/endpoint/suspicious_msbuild_rename/) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | TTP | +| [Suspicious MSBuild Spawn](/endpoint/suspicious_msbuild_spawn/) | [MSBuild](/tags/#msbuild) | TTP | +| [Suspicious PlistBuddy Usage](/endpoint/suspicious_plistbuddy_usage/) | [Launch Agent](/tags/#launch-agent) | TTP | +| [Suspicious PlistBuddy Usage via OSquery](/endpoint/suspicious_plistbuddy_usage_via_osquery/) | [Launch Agent](/tags/#launch-agent) | TTP | +| [Suspicious Process File Path](/endpoint/suspicious_process_file_path/) | [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | +| [Suspicious Reg exe Process](/endpoint/suspicious_reg_exe_process/) | [Modify Registry](/tags/#modify-registry) | TTP | +| [Suspicious Regsvr32 Register Suspicious Path](/endpoint/suspicious_regsvr32_register_suspicious_path/) | [Regsvr32](/tags/#regsvr32) | TTP | +| [Suspicious Rundll32 PluginInit](/endpoint/suspicious_rundll32_plugininit/) | [Rundll32](/tags/#rundll32) | TTP | +| [Suspicious Rundll32 Rename](/endpoint/suspicious_rundll32_rename/) | [Rundll32](/tags/#rundll32), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | +| [Suspicious Rundll32 StartW](/endpoint/suspicious_rundll32_startw/) | [Rundll32](/tags/#rundll32) | TTP | +| [Suspicious Rundll32 dllregisterserver](/endpoint/suspicious_rundll32_dllregisterserver/) | [Rundll32](/tags/#rundll32) | TTP | +| [Suspicious Rundll32 no Command Line Arguments](/endpoint/suspicious_rundll32_no_command_line_arguments/) | [Rundll32](/tags/#rundll32) | TTP | +| [Suspicious SQLite3 LSQuarantine Behavior](/endpoint/suspicious_sqlite3_lsquarantine_behavior/) | [Data Staged](/tags/#data-staged) | TTP | +| [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task) | Anomaly | +| [Suspicious SearchProtocolHost no Command Line Arguments](/endpoint/suspicious_searchprotocolhost_no_command_line_arguments/) | [Process Injection](/tags/#process-injection) | TTP | +| [Suspicious WAV file in Appdata Folder](/endpoint/suspicious_wav_file_in_appdata_folder/) | [Screen Capture](/tags/#screen-capture) | TTP | +| [Suspicious microsoft workflow compiler rename](/endpoint/suspicious_microsoft_workflow_compiler_rename/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | +| [Suspicious microsoft workflow compiler usage](/endpoint/suspicious_microsoft_workflow_compiler_usage/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | TTP | +| [Suspicious msbuild path](/endpoint/suspicious_msbuild_path/) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | TTP | +| [Suspicious mshta child process](/endpoint/suspicious_mshta_child_process/) | [Mshta](/tags/#mshta) | TTP | +| [Suspicious mshta spawn](/endpoint/suspicious_mshta_spawn/) | [Mshta](/tags/#mshta) | TTP | +| [Suspicious wevtutil Usage](/endpoint/suspicious_wevtutil_usage/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Suspicious writes to windows Recycle Bin](/endpoint/suspicious_writes_to_windows_recycle_bin/) | [Masquerading](/tags/#masquerading) | TTP | +| [System Information Discovery Detection](/endpoint/system_information_discovery_detection/) | [System Information Discovery](/tags/#system-information-discovery) | TTP | +| [System Process Running from Unexpected Location](/endpoint/system_process_running_from_unexpected_location/) | [Masquerading](/tags/#masquerading) | Anomaly | +| [System Processes Run From Unexpected Locations](/endpoint/system_processes_run_from_unexpected_locations/) | [Rename System Utilities](/tags/#rename-system-utilities) | TTP | +| [System User Discovery With Query](/endpoint/system_user_discovery_with_query/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Hunting | +| [System User Discovery With Whoami](/endpoint/system_user_discovery_with_whoami/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Hunting | +| [TOR Traffic](/network/tor_traffic/) | [Web Protocols](/tags/#web-protocols) | TTP | +| [Trickbot Named Pipe](/endpoint/trickbot_named_pipe/) | [Process Injection](/tags/#process-injection) | TTP | +| [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | +| [UAC Bypass With Colorui COM Object](/endpoint/uac_bypass_with_colorui_com_object/) | [CMSTP](/tags/#cmstp) | TTP | +| [USN Journal Deletion](/endpoint/usn_journal_deletion/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | +| [Unified Messaging Service Spawning a Process](/endpoint/unified_messaging_service_spawning_a_process/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | +| [Uninstall App Using MsiExec](/endpoint/uninstall_app_using_msiexec/) | [Msiexec](/tags/#msiexec) | TTP | +| [Unload Sysmon Filter Driver](/endpoint/unload_sysmon_filter_driver/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Unloading AMSI via Reflection](/endpoint/unloading_amsi_via_reflection/) | [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Unusually Long Command Line]() | None | Anomaly | +| [Unusually Long Command Line]() | None | Anomaly | +| [Unusually Long Command Line - MLTK]() | None | Anomaly | +| [Unusually Long Content-Type Length]() | None | Anomaly | +| [User Discovery With Env Vars PowerShell](/endpoint/user_discovery_with_env_vars_powershell/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Hunting | +| [User Discovery With Env Vars PowerShell Script Block](/endpoint/user_discovery_with_env_vars_powershell_script_block/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Hunting | +| [W3WP Spawning Shell](/endpoint/w3wp_spawning_shell/) | [Web Shell](/tags/#web-shell) | TTP | +| [WBAdmin Delete System Backups](/endpoint/wbadmin_delete_system_backups/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | +| [WMI Permanent Event Subscription](/endpoint/wmi_permanent_event_subscription/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP | +| [WMI Permanent Event Subscription - Sysmon](/endpoint/wmi_permanent_event_subscription_-_sysmon/) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription) | TTP | +| [WMI Recon Running Process Or Services](/endpoint/wmi_recon_running_process_or_services/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | TTP | +| [WMI Temporary Event Subscription](/endpoint/wmi_temporary_event_subscription/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP | +| [WSReset UAC Bypass](/endpoint/wsreset_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | +| [Wbemprox COM Object Execution](/endpoint/wbemprox_com_object_execution/) | [CMSTP](/tags/#cmstp) | TTP | +| [Web Servers Executing Suspicious Processes](/application/web_servers_executing_suspicious_processes/) | [System Information Discovery](/tags/#system-information-discovery) | TTP | +| [Wermgr Process Connecting To IP Check Web Services](/endpoint/wermgr_process_connecting_to_ip_check_web_services/) | [IP Addresses](/tags/#ip-addresses) | TTP | +| [Wermgr Process Create Executable File](/endpoint/wermgr_process_create_executable_file/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information) | TTP | +| [Wermgr Process Spawned CMD Or Powershell Process](/endpoint/wermgr_process_spawned_cmd_or_powershell_process/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | +| [WevtUtil Usage To Clear Logs](/endpoint/wevtutil_usage_to_clear_logs/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Wevtutil Usage To Disable Logs](/endpoint/wevtutil_usage_to_disable_logs/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task) | TTP | +| [WinEvent Scheduled Task Created to Spawn Shell](/endpoint/winevent_scheduled_task_created_to_spawn_shell/) | [Scheduled Task](/tags/#scheduled-task) | TTP | +| [WinRM Spawning a Process](/endpoint/winrm_spawning_a_process/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | +| [Windows AdFind Exe](/endpoint/windows_adfind_exe/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | +| [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | +| [Windows Event Log Cleared](/endpoint/windows_event_log_cleared/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Windows Security Account Manager Stopped](/endpoint/windows_security_account_manager_stopped/) | [Service Stop](/tags/#service-stop) | TTP | +| [Winword Spawning Cmd](/endpoint/winword_spawning_cmd/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Winword Spawning PowerShell](/endpoint/winword_spawning_powershell/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Winword Spawning Windows Script Host](/endpoint/winword_spawning_windows_script_host/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Wmic Group Discovery](/endpoint/wmic_group_discovery/) | [Local Groups](/tags/#local-groups) | Hunting | +| [Write Executable in SMB Share](/endpoint/write_executable_in_smb_share/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | +| [XMRIG Driver Loaded](/endpoint/xmrig_driver_loaded/) | [Windows Service](/tags/#windows-service) | TTP | +| [XSL Script Execution With WMIC](/endpoint/xsl_script_execution_with_wmic/) | [XSL Script Processing](/tags/#xsl-script-processing) | TTP | +| [aws detect attach to role policy](/cloud/aws_detect_attach_to_role_policy/) | [Valid Accounts](/tags/#valid-accounts) | Hunting | +| [aws detect permanent key creation](/cloud/aws_detect_permanent_key_creation/) | [Valid Accounts](/tags/#valid-accounts) | Hunting | +| [aws detect role creation](/cloud/aws_detect_role_creation/) | [Valid Accounts](/tags/#valid-accounts) | Hunting | +| [aws detect sts assume role abuse](/cloud/aws_detect_sts_assume_role_abuse/) | [Valid Accounts](/tags/#valid-accounts) | Hunting | +| [aws detect sts get session token abuse](/cloud/aws_detect_sts_get_session_token_abuse/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material) | Hunting | \ No newline at end of file diff --git a/docs/_pages/lateral_movement.md b/docs/_pages/lateral_movement.md index 0408a693cd..42acf4eb27 100644 --- a/docs/_pages/lateral_movement.md +++ b/docs/_pages/lateral_movement.md @@ -10,4 +10,4 @@ sidebar: | Name | Technique | Tactic | | ----------- | ----------- |--------------| -| [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527/) | [Print Processors](/tags/#print-processors), [Rundll32](/tags/#rundll32), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Persistence](/tags/#persistence) | \ No newline at end of file +| [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527/) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | \ No newline at end of file diff --git a/docs/_pages/malware.md b/docs/_pages/malware.md index b2d9ee34c6..db8e2eae05 100644 --- a/docs/_pages/malware.md +++ b/docs/_pages/malware.md @@ -10,25 +10,25 @@ sidebar: | Name | Technique | Tactic | | ----------- | ----------- |--------------| -| [BlackMatter Ransomware](/stories/blackmatter_ransomware/) | [Credentials in Registry](/tags/#credentials-in-registry), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Defacement](/tags/#defacement), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Credential Access](/tags/#credential-access) | -| [Clop Ransomware](/stories/clop_ransomware/) | [User Execution](/tags/#user-execution), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Data Destruction](/tags/#data-destruction), [Service Execution](/tags/#service-execution), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Service Stop](/tags/#service-stop), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Execution](/tags/#execution) | +| [BlackMatter Ransomware](/stories/blackmatter_ransomware/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) | +| [Clop Ransomware](/stories/clop_ransomware/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | | [ColdRoot MacOS RAT]() | None | None | -| [DHS Report TA18-074A](/stories/dhs_report_ta18-074a/) | [Local Account](/tags/#local-account), [File Transfer Protocols](/tags/#file-transfer-protocols), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [PowerShell](/tags/#powershell), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Windows Service](/tags/#windows-service), [Scheduled Task](/tags/#scheduled-task), [Malicious File](/tags/#malicious-file), [Modify Registry](/tags/#modify-registry) | [Persistence](/tags/#persistence) | -| [DarkSide Ransomware](/stories/darkside_ransomware/) | [Security Account Manager](/tags/#security-account-manager), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [CMSTP](/tags/#cmstp), [Process Injection](/tags/#process-injection), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [LSASS Memory](/tags/#lsass-memory), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Automated Exfiltration](/tags/#automated-exfiltration), [Service Execution](/tags/#service-execution), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Bypass User Account Control](/tags/#bypass-user-account-control) | [Credential Access](/tags/#credential-access) | -| [Dynamic DNS](/stories/dynamic_dns/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) | -| [Emotet Malware DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_/) | [Windows Command Shell](/tags/#windows-command-shell), [Software Deployment Tools](/tags/#software-deployment-tools), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Execution](/tags/#execution) | -| [FIN7](/stories/fin7/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery), [JavaScript](/tags/#javascript), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Spearphishing Attachment](/tags/#spearphishing-attachment), [XSL Script Processing](/tags/#xsl-script-processing) | [Discovery](/tags/#discovery) | -| [Hidden Cobra Malware](/stories/hidden_cobra_malware/) | [Network Share Connection Removal](/tags/#network-share-connection-removal), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [File Transfer Protocols](/tags/#file-transfer-protocols), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Defense Evasion](/tags/#defense-evasion) | -| [IcedID](/stories/icedid/) | [Domain Account](/tags/#domain-account), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [Malicious File](/tags/#malicious-file), [Bypass User Account Control](/tags/#bypass-user-account-control), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Regsvr32](/tags/#regsvr32), [IP Addresses](/tags/#ip-addresses), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Scheduled Task](/tags/#scheduled-task), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Discovery](/tags/#discovery) | -| [Orangeworm Attack Group](/stories/orangeworm_attack_group/) | [Service Execution](/tags/#service-execution), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Windows Service](/tags/#windows-service) | [Execution](/tags/#execution) | -| [Ransomware](/stories/ransomware/) | [Archive via Utility](/tags/#archive-via-utility), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Service Stop](/tags/#service-stop), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [CMSTP](/tags/#cmstp), [File Deletion](/tags/#file-deletion), [Data Destruction](/tags/#data-destruction), [User Execution](/tags/#user-execution), [Automated Exfiltration](/tags/#automated-exfiltration), [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Account Access Removal](/tags/#account-access-removal), [Service Execution](/tags/#service-execution), [Visual Basic](/tags/#visual-basic), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Modify Registry](/tags/#modify-registry), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Scheduled Task](/tags/#scheduled-task), [Rename System Utilities](/tags/#rename-system-utilities), [Web Protocols](/tags/#web-protocols), [Msiexec](/tags/#msiexec) | [Collection](/tags/#collection) | +| [DHS Report TA18-074A](/stories/dhs_report_ta18-074a/) | [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion) | +| [DarkSide Ransomware](/stories/darkside_ransomware/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | [Privilege Escalation](/tags/#privilege-escalation) | +| [Dynamic DNS](/stories/dynamic_dns/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) | +| [Emotet Malware DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | +| [FIN7](/stories/fin7/) | [XSL Script Processing](/tags/#xsl-script-processing) | [Defense Evasion](/tags/#defense-evasion) | +| [Hidden Cobra Malware](/stories/hidden_cobra_malware/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) | +| [IcedID](/stories/icedid/) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | +| [Orangeworm Attack Group](/stories/orangeworm_attack_group/) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) | +| [Ransomware](/stories/ransomware/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | | [Ransomware Cloud](/stories/ransomware_cloud/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) | -| [Remcos](/stories/remcos/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Masquerading](/tags/#masquerading), [Port Monitors](/tags/#port-monitors), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Application Shimming](/tags/#application-shimming), [Screen Capture](/tags/#screen-capture), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Privilege Escalation](/tags/#privilege-escalation) | -| [Revil Ransomware](/stories/revil_ransomware/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [User Execution](/tags/#user-execution), [Modify Registry](/tags/#modify-registry), [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion) | -| [Ryuk Ransomware](/stories/ryuk_ransomware/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Data Destruction](/tags/#data-destruction), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Command Shell](/tags/#windows-command-shell), [Scheduled Task](/tags/#scheduled-task), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) | -| [SamSam Ransomware](/stories/samsam_ransomware/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping), [Service Stop](/tags/#service-stop), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Account Access Removal](/tags/#account-access-removal), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Software Deployment Tools](/tags/#software-deployment-tools), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Rundll32](/tags/#rundll32), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Defense Evasion](/tags/#defense-evasion) | -| [Trickbot](/stories/trickbot/) | [Domain Account](/tags/#domain-account), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [Malicious File](/tags/#malicious-file), [Bypass User Account Control](/tags/#bypass-user-account-control), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Regsvr32](/tags/#regsvr32), [IP Addresses](/tags/#ip-addresses), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Scheduled Task](/tags/#scheduled-task), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Discovery](/tags/#discovery) | -| [Unusual Processes](/stories/unusual_processes/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping), [Service Stop](/tags/#service-stop), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Account Access Removal](/tags/#account-access-removal), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Software Deployment Tools](/tags/#software-deployment-tools), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Rundll32](/tags/#rundll32), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Defense Evasion](/tags/#defense-evasion) | -| [Windows File Extension and Association Abuse](/stories/windows_file_extension_and_association_abuse/) | [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [Rundll32](/tags/#rundll32), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) | -| [Windows Service Abuse](/stories/windows_service_abuse/) | [Service Execution](/tags/#service-execution), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Windows Service](/tags/#windows-service) | [Execution](/tags/#execution) | -| [XMRig](/stories/xmrig/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping), [Service Stop](/tags/#service-stop), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Account Access Removal](/tags/#account-access-removal), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Software Deployment Tools](/tags/#software-deployment-tools), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Rundll32](/tags/#rundll32), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Defense Evasion](/tags/#defense-evasion) | \ No newline at end of file +| [Remcos](/stories/remcos/) | [Screen Capture](/tags/#screen-capture) | [Collection](/tags/#collection) | +| [Revil Ransomware](/stories/revil_ransomware/) | [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion) | +| [Ryuk Ransomware](/stories/ryuk_ransomware/) | [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) | +| [SamSam Ransomware](/stories/samsam_ransomware/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) | +| [Trickbot](/stories/trickbot/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) | +| [Unusual Processes](/stories/unusual_processes/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | +| [Windows File Extension and Association Abuse](/stories/windows_file_extension_and_association_abuse/) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | +| [Windows Service Abuse](/stories/windows_service_abuse/) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) | +| [XMRig](/stories/xmrig/) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) | \ No newline at end of file diff --git a/docs/_pages/playbooks.md b/docs/_pages/playbooks.md index 1a316ea08b..138b2993a5 100644 --- a/docs/_pages/playbooks.md +++ b/docs/_pages/playbooks.md @@ -1,8 +1,13 @@ --- title: "Playbooks" -layout: single +layout: collection author_profile: false permalink: /playbooks/ +classes: wide +sidebar: + nav: "playbooks" --- -### Come back soon, work in progress 👷‍♀️ 🏗 .. +| Name | Detections | Type | +| --------| ---------- | ----------- | +| [Ransomware Investigate and Contain](/playbooks/ransomware_investigate_and_contain/)|[Conti Common Exec parameter](/detections/TTP/conti_common_exec_parameter)| Response | \ No newline at end of file diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md index 9b29436bb3..bedf6ebda7 100644 --- a/docs/_pages/stories.md +++ b/docs/_pages/stories.md @@ -10,107 +10,107 @@ sidebar: | Name | Technique | Tactic | | ----------- | ----------- |--------------| -| [AWS Cross Account Activity](aws_cross_account_activity) | [Valid Accounts](/tags/#valid-accounts), [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material) | [Defense Evasion](/tags/#defense-evasion) | -| [AWS IAM Privilege Escalation](aws_iam_privilege_escalation) | [Cloud Accounts](/tags/#cloud-accounts), [Cloud Account](/tags/#cloud-account), [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [Brute Force](/tags/#brute-force), [Account Manipulation](/tags/#account-manipulation), [Cloud Groups](/tags/#cloud-groups) | [Defense Evasion](/tags/#defense-evasion) | +| [AWS Cross Account Activity](aws_cross_account_activity) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material) | [Defense Evasion](/tags/#defense-evasion) | +| [AWS IAM Privilege Escalation](aws_iam_privilege_escalation) | [Cloud Account](/tags/#cloud-account) | [Persistence](/tags/#persistence) | | [AWS Network ACL Activity](aws_network_acl_activity) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | [Defense Evasion](/tags/#defense-evasion) | | [AWS Security Hub Alerts]() | None | None | | [AWS User Monitoring](aws_user_monitoring) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) | -| [Active Directory Discovery](active_directory_discovery) | [Domain Account](/tags/#domain-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote System Discovery](/tags/#remote-system-discovery), [Domain Groups](/tags/#domain-groups), [Password Policy Discovery](/tags/#password-policy-discovery), [Local Groups](/tags/#local-groups), [System Owner/User Discovery](/tags/#system-owner/user-discovery), [Local Account](/tags/#local-account), [System Network Connections Discovery](/tags/#system-network-connections-discovery) | [Discovery](/tags/#discovery) | +| [Active Directory Discovery](active_directory_discovery) | [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) | | [Active Directory Password Spraying](active_directory_password_spraying) | [Password Spraying](/tags/#password-spraying) | [Credential Access](/tags/#credential-access) | | [Apache Struts Vulnerability](apache_struts_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) | | [Asset Tracking]() | None | None | -| [BITS Jobs](bits_jobs) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Defense Evasion](/tags/#defense-evasion) | +| [BITS Jobs](bits_jobs) | [BITS Jobs](/tags/#bits-jobs) | [Defense Evasion](/tags/#defense-evasion) | | [Baron Samedit CVE-2021-3156](baron_samedit_cve-2021-3156) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) | -| [BlackMatter Ransomware](blackmatter_ransomware) | [Credentials in Registry](/tags/#credentials-in-registry), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Defacement](/tags/#defacement), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Credential Access](/tags/#credential-access) | +| [BlackMatter Ransomware](blackmatter_ransomware) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) | | [Brand Monitoring]() | None | None | -| [Clop Ransomware](clop_ransomware) | [User Execution](/tags/#user-execution), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Data Destruction](/tags/#data-destruction), [Service Execution](/tags/#service-execution), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Service Stop](/tags/#service-stop), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Execution](/tags/#execution) | -| [Cloud Cryptomining](cloud_cryptomining) | [Cloud Accounts](/tags/#cloud-accounts), [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) | -| [Cloud Federated Credential Abuse](cloud_federated_credential_abuse) | [Valid Accounts](/tags/#valid-accounts), [LSASS Memory](/tags/#lsass-memory), [Cloud Account](/tags/#cloud-account), [Modify Authentication Process](/tags/#modify-authentication-process), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Defense Evasion](/tags/#defense-evasion) | -| [Cobalt Strike](cobalt_strike) | [Archive via Utility](/tags/#archive-via-utility), [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service), [Process Injection](/tags/#process-injection), [File Transfer Protocols](/tags/#file-transfer-protocols), [Regsvr32](/tags/#regsvr32), [Mshta](/tags/#mshta), [Service Execution](/tags/#service-execution), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Rundll32](/tags/#rundll32), [Scheduled Task](/tags/#scheduled-task), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Web Shell](/tags/#web-shell), [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Web Protocols](/tags/#web-protocols), [Remote System Discovery](/tags/#remote-system-discovery) | [Collection](/tags/#collection) | +| [Clop Ransomware](clop_ransomware) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | +| [Cloud Cryptomining](cloud_cryptomining) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) | +| [Cloud Federated Credential Abuse](cloud_federated_credential_abuse) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) | +| [Cobalt Strike](cobalt_strike) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | | [ColdRoot MacOS RAT]() | None | None | -| [Collection and Staging](collection_and_staging) | [Archive via Utility](/tags/#archive-via-utility), [Local Email Collection](/tags/#local-email-collection), [Remote Email Collection](/tags/#remote-email-collection), [Masquerading](/tags/#masquerading) | [Collection](/tags/#collection) | -| [Command and Control](command_and_control) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) | +| [Collection and Staging](collection_and_staging) | [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) | +| [Command and Control](command_and_control) | [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) | | [Container Implantation Monitoring and Investigation](container_implantation_monitoring_and_investigation) | [Implant Internal Image](/tags/#implant-internal-image) | [Persistence](/tags/#persistence) | -| [Credential Dumping](credential_dumping) | [LSASS Memory](/tags/#lsass-memory), [Process Injection](/tags/#process-injection), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Access Token Manipulation](/tags/#access-token-manipulation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Modify Authentication Process](/tags/#modify-authentication-process), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Account Discovery](/tags/#account-discovery), [Password Policy Discovery](/tags/#password-policy-discovery), [Unsecured Credentials](/tags/#unsecured-credentials), [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager), [NTDS](/tags/#ntds), [Kerberoasting](/tags/#kerberoasting), [PowerShell](/tags/#powershell) | [Credential Access](/tags/#credential-access) | -| [DHS Report TA18-074A](dhs_report_ta18-074a) | [Local Account](/tags/#local-account), [File Transfer Protocols](/tags/#file-transfer-protocols), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [PowerShell](/tags/#powershell), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Windows Service](/tags/#windows-service), [Scheduled Task](/tags/#scheduled-task), [Malicious File](/tags/#malicious-file), [Modify Registry](/tags/#modify-registry) | [Persistence](/tags/#persistence) | +| [Credential Dumping](credential_dumping) | [PowerShell](/tags/#powershell) | [Execution](/tags/#execution) | +| [DHS Report TA18-074A](dhs_report_ta18-074a) | [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion) | | [DNS Amplification Attacks](dns_amplification_attacks) | [Reflection Amplification](/tags/#reflection-amplification) | [Impact](/tags/#impact) | | [DNS Hijacking](dns_hijacking) | [Drive-by Compromise](/tags/#drive-by-compromise) | [Initial Access](/tags/#initial-access) | -| [DarkSide Ransomware](darkside_ransomware) | [Security Account Manager](/tags/#security-account-manager), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [CMSTP](/tags/#cmstp), [Process Injection](/tags/#process-injection), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [LSASS Memory](/tags/#lsass-memory), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Automated Exfiltration](/tags/#automated-exfiltration), [Service Execution](/tags/#service-execution), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Bypass User Account Control](/tags/#bypass-user-account-control) | [Credential Access](/tags/#credential-access) | -| [Data Exfiltration](data_exfiltration) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) | +| [DarkSide Ransomware](darkside_ransomware) | [Bypass User Account Control](/tags/#bypass-user-account-control) | [Privilege Escalation](/tags/#privilege-escalation) | +| [Data Exfiltration](data_exfiltration) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | [Exfiltration](/tags/#exfiltration) | | [Data Protection](data_protection) | [Drive-by Compromise](/tags/#drive-by-compromise) | [Initial Access](/tags/#initial-access) | | [Deobfuscate-Decode Files or Information](deobfuscate-decode_files_or_information) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information) | [Defense Evasion](/tags/#defense-evasion) | -| [Detect Zerologon Attack](detect_zerologon_attack) | [Exploitation of Remote Services](/tags/#exploitation-of-remote-services), [LSASS Memory](/tags/#lsass-memory), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Lateral Movement](/tags/#lateral-movement) | -| [Dev Sec Ops](dev_sec_ops) | [Malicious Image](/tags/#malicious-image), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Exploitation for Credential Access](/tags/#exploitation-for-credential-access), [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Execution](/tags/#execution) | -| [Disabling Security Tools](disabling_security_tools) | [Install Root Certificate](/tags/#install-root-certificate), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Windows Service](/tags/#windows-service), [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion) | -| [Domain Trust Discovery](domain_trust_discovery) | [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | -| [Dynamic DNS](dynamic_dns) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) | -| [Emotet Malware DHS Report TA18-201A ](emotet_malware__dhs_report_ta18-201a_) | [Windows Command Shell](/tags/#windows-command-shell), [Software Deployment Tools](/tags/#software-deployment-tools), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Execution](/tags/#execution) | +| [Detect Zerologon Attack](detect_zerologon_attack) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | +| [Dev Sec Ops](dev_sec_ops) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) | +| [Disabling Security Tools](disabling_security_tools) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | +| [Domain Trust Discovery](domain_trust_discovery) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | +| [Dynamic DNS](dynamic_dns) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) | +| [Emotet Malware DHS Report TA18-201A ](emotet_malware__dhs_report_ta18-201a_) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | | [F5 TMUI RCE CVE-2020-5902](f5_tmui_rce_cve-2020-5902) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | -| [FIN7](fin7) | [System Owner/User Discovery](/tags/#system-owner/user-discovery), [JavaScript](/tags/#javascript), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Spearphishing Attachment](/tags/#spearphishing-attachment), [XSL Script Processing](/tags/#xsl-script-processing) | [Discovery](/tags/#discovery) | +| [FIN7](fin7) | [XSL Script Processing](/tags/#xsl-script-processing) | [Defense Evasion](/tags/#defense-evasion) | | [GCP Cross Account Activity](gcp_cross_account_activity) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | -| [HAFNIUM Group](hafnium_group) | [PowerShell](/tags/#powershell), [Web Shell](/tags/#web-shell), [Local Account](/tags/#local-account), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [LSASS Memory](/tags/#lsass-memory), [Remote Email Collection](/tags/#remote-email-collection), [NTDS](/tags/#ntds), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Execution](/tags/#execution) | -| [Hidden Cobra Malware](hidden_cobra_malware) | [Network Share Connection Removal](/tags/#network-share-connection-removal), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [File Transfer Protocols](/tags/#file-transfer-protocols), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Defense Evasion](/tags/#defense-evasion) | -| [IcedID](icedid) | [Domain Account](/tags/#domain-account), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [Malicious File](/tags/#malicious-file), [Bypass User Account Control](/tags/#bypass-user-account-control), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Regsvr32](/tags/#regsvr32), [IP Addresses](/tags/#ip-addresses), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Scheduled Task](/tags/#scheduled-task), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Discovery](/tags/#discovery) | -| [Ingress Tool Transfer](ingress_tool_transfer) | [PowerShell](/tags/#powershell), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [OS Credential Dumping](/tags/#os-credential-dumping), [Remote Services](/tags/#remote-services), [Screen Capture](/tags/#screen-capture), [Audio Capture](/tags/#audio-capture), [Remote Service Session Hijacking](/tags/#remote-service-session-hijacking), [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Impair Defenses](/tags/#impair-defenses) | [Execution](/tags/#execution) | +| [HAFNIUM Group](hafnium_group) | [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) | +| [Hidden Cobra Malware](hidden_cobra_malware) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) | +| [IcedID](icedid) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | +| [Ingress Tool Transfer](ingress_tool_transfer) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control) | | [JBoss Vulnerability](jboss_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) | | [Kubernetes Scanning Activity](kubernetes_scanning_activity) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) | | [Kubernetes Sensitive Object Access Activity]() | None | None | -| [Lateral Movement](lateral_movement) | [Pass the Hash](/tags/#pass-the-hash), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [Kerberoasting](/tags/#kerberoasting), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Scheduled Task](/tags/#scheduled-task) | [Defense Evasion](/tags/#defense-evasion) | -| [Malicious PowerShell](malicious_powershell) | [PowerShell](/tags/#powershell), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [OS Credential Dumping](/tags/#os-credential-dumping), [Remote Services](/tags/#remote-services), [Screen Capture](/tags/#screen-capture), [Audio Capture](/tags/#audio-capture), [Remote Service Session Hijacking](/tags/#remote-service-session-hijacking), [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Impair Defenses](/tags/#impair-defenses) | [Execution](/tags/#execution) | -| [Masquerading - Rename System Utilities](masquerading_-_rename_system_utilities) | [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [Rundll32](/tags/#rundll32), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) | +| [Lateral Movement](lateral_movement) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | +| [Malicious PowerShell](malicious_powershell) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | [Reconnaissance](/tags/#reconnaissance) | +| [Masquerading - Rename System Utilities](masquerading_-_rename_system_utilities) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | | [Meterpreter](meterpreter) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | [Discovery](/tags/#discovery) | -| [Microsoft MSHTML Remote Code Execution CVE-2021-40444](microsoft_mshtml_remote_code_execution_cve-2021-40444) | [Control Panel](/tags/#control-panel), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | +| [Microsoft MSHTML Remote Code Execution CVE-2021-40444](microsoft_mshtml_remote_code_execution_cve-2021-40444) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | | [Monitor for Updates]() | None | None | -| [NOBELIUM Group](nobelium_group) | [Archive via Utility](/tags/#archive-via-utility), [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service), [Process Injection](/tags/#process-injection), [File Transfer Protocols](/tags/#file-transfer-protocols), [Regsvr32](/tags/#regsvr32), [Mshta](/tags/#mshta), [Service Execution](/tags/#service-execution), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Rundll32](/tags/#rundll32), [Scheduled Task](/tags/#scheduled-task), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Web Shell](/tags/#web-shell), [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Web Protocols](/tags/#web-protocols), [Remote System Discovery](/tags/#remote-system-discovery) | [Collection](/tags/#collection) | +| [NOBELIUM Group](nobelium_group) | [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | | [Netsh Abuse](netsh_abuse) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall) | [Defense Evasion](/tags/#defense-evasion) | -| [Office 365 Detections](office_365_detections) | [Password Guessing](/tags/#password-guessing), [Cloud Account](/tags/#cloud-account), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Modify Authentication Process](/tags/#modify-authentication-process), [Brute Force](/tags/#brute-force), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Remote Email Collection](/tags/#remote-email-collection) | [Credential Access](/tags/#credential-access) | -| [Orangeworm Attack Group](orangeworm_attack_group) | [Service Execution](/tags/#service-execution), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Windows Service](/tags/#windows-service) | [Execution](/tags/#execution) | -| [PetitPotam NTLM Relay on Active Directory Certificate Services](petitpotam_ntlm_relay_on_active_directory_certificate_services) | [Forced Authentication](/tags/#forced-authentication), [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) | -| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns) | [PowerShell](/tags/#powershell), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | [Execution](/tags/#execution) | -| [PrintNightmare CVE-2021-34527](printnightmare_cve-2021-34527) | [Print Processors](/tags/#print-processors), [Rundll32](/tags/#rundll32), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Persistence](/tags/#persistence) | -| [Prohibited Traffic Allowed or Protocol Mismatch](prohibited_traffic_allowed_or_protocol_mismatch) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Drive-by Compromise](/tags/#drive-by-compromise), [Remote Services](/tags/#remote-services), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Web Protocols](/tags/#web-protocols) | [Lateral Movement](/tags/#lateral-movement) | -| [ProxyShell](proxyshell) | [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [PowerShell](/tags/#powershell) | [Persistence](/tags/#persistence) | -| [Ransomware](ransomware) | [Archive via Utility](/tags/#archive-via-utility), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Service Stop](/tags/#service-stop), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [CMSTP](/tags/#cmstp), [File Deletion](/tags/#file-deletion), [Data Destruction](/tags/#data-destruction), [User Execution](/tags/#user-execution), [Automated Exfiltration](/tags/#automated-exfiltration), [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Account Access Removal](/tags/#account-access-removal), [Service Execution](/tags/#service-execution), [Visual Basic](/tags/#visual-basic), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Modify Registry](/tags/#modify-registry), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Scheduled Task](/tags/#scheduled-task), [Rename System Utilities](/tags/#rename-system-utilities), [Web Protocols](/tags/#web-protocols), [Msiexec](/tags/#msiexec) | [Collection](/tags/#collection) | +| [Office 365 Detections](office_365_detections) | [Email Forwarding Rule](/tags/#email-forwarding-rule) | [Collection](/tags/#collection) | +| [Orangeworm Attack Group](orangeworm_attack_group) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) | +| [PetitPotam NTLM Relay on Active Directory Certificate Services](petitpotam_ntlm_relay_on_active_directory_certificate_services) | [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) | +| [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | [Persistence](/tags/#persistence) | +| [PrintNightmare CVE-2021-34527](printnightmare_cve-2021-34527) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | +| [Prohibited Traffic Allowed or Protocol Mismatch](prohibited_traffic_allowed_or_protocol_mismatch) | [Web Protocols](/tags/#web-protocols) | [Command And Control](/tags/#command-and-control) | +| [ProxyShell](proxyshell) | [Web Shell](/tags/#web-shell) | [Persistence](/tags/#persistence) | +| [Ransomware](ransomware) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | | [Ransomware Cloud](ransomware_cloud) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) | -| [Remcos](remcos) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Masquerading](/tags/#masquerading), [Port Monitors](/tags/#port-monitors), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Application Shimming](/tags/#application-shimming), [Screen Capture](/tags/#screen-capture), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Privilege Escalation](/tags/#privilege-escalation) | -| [Revil Ransomware](revil_ransomware) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [User Execution](/tags/#user-execution), [Modify Registry](/tags/#modify-registry), [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion) | -| [Router and Infrastructure Security](router_and_infrastructure_security) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [ARP Cache Poisoning](/tags/#arp-cache-poisoning), [Man-in-the-Middle](/tags/#man-in-the-middle), [TFTP Boot](/tags/#tftp-boot), [Traffic Duplication](/tags/#traffic-duplication) | [Initial Access](/tags/#initial-access) | -| [Ryuk Ransomware](ryuk_ransomware) | [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Data Destruction](/tags/#data-destruction), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Command Shell](/tags/#windows-command-shell), [Scheduled Task](/tags/#scheduled-task), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) | +| [Remcos](remcos) | [Screen Capture](/tags/#screen-capture) | [Collection](/tags/#collection) | +| [Revil Ransomware](revil_ransomware) | [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion) | +| [Router and Infrastructure Security](router_and_infrastructure_security) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Traffic Duplication](/tags/#traffic-duplication) | [Initial Access](/tags/#initial-access) | +| [Ryuk Ransomware](ryuk_ransomware) | [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) | | [SQL Injection](sql_injection) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | -| [SamSam Ransomware](samsam_ransomware) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping), [Service Stop](/tags/#service-stop), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Account Access Removal](/tags/#account-access-removal), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Software Deployment Tools](/tags/#software-deployment-tools), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Rundll32](/tags/#rundll32), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Defense Evasion](/tags/#defense-evasion) | -| [Silver Sparrow](silver_sparrow) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Launch Agent](/tags/#launch-agent), [Data Staged](/tags/#data-staged) | [Command And Control](/tags/#command-and-control) | -| [Spearphishing Attachments](spearphishing_attachments) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Security Account Manager](/tags/#security-account-manager), [Spearphishing Link](/tags/#spearphishing-link) | [Initial Access](/tags/#initial-access) | +| [SamSam Ransomware](samsam_ransomware) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) | +| [Silver Sparrow](silver_sparrow) | [Data Staged](/tags/#data-staged) | [Collection](/tags/#collection) | +| [Spearphishing Attachments](spearphishing_attachments) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | | [Suspicious AWS Login Activities](suspicious_aws_login_activities) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) | | [Suspicious AWS S3 Activities](suspicious_aws_s3_activities) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) | | [Suspicious AWS Traffic]() | None | None | | [Suspicious Cloud Authentication Activities](suspicious_cloud_authentication_activities) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious Cloud Instance Activities](suspicious_cloud_instance_activities) | [Cloud Accounts](/tags/#cloud-accounts), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious Cloud Instance Activities](suspicious_cloud_instance_activities) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Exfiltration](/tags/#exfiltration) | | [Suspicious Cloud Provisioning Activities](suspicious_cloud_provisioning_activities) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious Cloud User Activities](suspicious_cloud_user_activities) | [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | [Discovery](/tags/#discovery) | -| [Suspicious Command-Line Executions](suspicious_command-line_executions) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Rename System Utilities](/tags/#rename-system-utilities) | [Execution](/tags/#execution) | +| [Suspicious Cloud User Activities](suspicious_cloud_user_activities) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious Command-Line Executions](suspicious_command-line_executions) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | | [Suspicious Compiled HTML Activity](suspicious_compiled_html_activity) | [Compiled HTML File](/tags/#compiled-html-file) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious DNS Traffic](suspicious_dns_traffic) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | [Exfiltration](/tags/#exfiltration) | +| [Suspicious DNS Traffic](suspicious_dns_traffic) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) | | [Suspicious Emails](suspicious_emails) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | | [Suspicious GCP Storage Activities](suspicious_gcp_storage_activities) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) | -| [Suspicious MSHTA Activity](suspicious_mshta_activity) | [Mshta](/tags/#mshta), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious MSHTA Activity](suspicious_mshta_activity) | [Mshta](/tags/#mshta) | [Defense Evasion](/tags/#defense-evasion) | | [Suspicious Okta Activity](suspicious_okta_activity) | [Default Accounts](/tags/#default-accounts) | [Defense Evasion](/tags/#defense-evasion) | | [Suspicious Regsvcs Regasm Activity](suspicious_regsvcs_regasm_activity) | [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [Defense Evasion](/tags/#defense-evasion) | | [Suspicious Regsvr32 Activity](suspicious_regsvr32_activity) | [Regsvr32](/tags/#regsvr32) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious Rundll32 Activity](suspicious_rundll32_activity) | [Rundll32](/tags/#rundll32), [LSASS Memory](/tags/#lsass-memory), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious WMI Use](suspicious_wmi_use) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription), [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [Privilege Escalation](/tags/#privilege-escalation) | -| [Suspicious Windows Registry Activities](suspicious_windows_registry_activities) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Masquerading](/tags/#masquerading), [Port Monitors](/tags/#port-monitors), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Application Shimming](/tags/#application-shimming), [Screen Capture](/tags/#screen-capture), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Privilege Escalation](/tags/#privilege-escalation) | -| [Suspicious Zoom Child Processes](suspicious_zoom_child_processes) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Rename System Utilities](/tags/#rename-system-utilities) | [Execution](/tags/#execution) | -| [Trickbot](trickbot) | [Domain Account](/tags/#domain-account), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [Malicious File](/tags/#malicious-file), [Bypass User Account Control](/tags/#bypass-user-account-control), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Regsvr32](/tags/#regsvr32), [IP Addresses](/tags/#ip-addresses), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Scheduled Task](/tags/#scheduled-task), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Discovery](/tags/#discovery) | -| [Trusted Developer Utilities Proxy Execution](trusted_developer_utilities_proxy_execution) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious Rundll32 Activity](suspicious_rundll32_activity) | [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious WMI Use](suspicious_wmi_use) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [Execution](/tags/#execution) | +| [Suspicious Windows Registry Activities](suspicious_windows_registry_activities) | [Application Shimming](/tags/#application-shimming) | [Privilege Escalation](/tags/#privilege-escalation) | +| [Suspicious Zoom Child Processes](suspicious_zoom_child_processes) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) | +| [Trickbot](trickbot) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) | +| [Trusted Developer Utilities Proxy Execution](trusted_developer_utilities_proxy_execution) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | [Defense Evasion](/tags/#defense-evasion) | | [Trusted Developer Utilities Proxy Execution MSBuild](trusted_developer_utilities_proxy_execution_msbuild) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | -| [Unusual Processes](unusual_processes) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping), [Service Stop](/tags/#service-stop), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Account Access Removal](/tags/#account-access-removal), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Software Deployment Tools](/tags/#software-deployment-tools), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Rundll32](/tags/#rundll32), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Defense Evasion](/tags/#defense-evasion) | +| [Unusual Processes](unusual_processes) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | | [Use of Cleartext Protocols]() | None | None | | [Windows DNS SIGRed CVE-2020-1350](windows_dns_sigred_cve-2020-1350) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) | -| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Bypass User Account Control](/tags/#bypass-user-account-control), [Modify Registry](/tags/#modify-registry), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) | -| [Windows Discovery Techniques](windows_discovery_techniques) | [Valid Accounts](/tags/#valid-accounts), [Account Discovery](/tags/#account-discovery), [Domain Policy Modification](/tags/#domain-policy-modification), [Trusted Relationship](/tags/#trusted-relationship), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Gather Victim Org Information](/tags/#gather-victim-org-information), [Active Scanning](/tags/#active-scanning), [Gather Victim Host Information](/tags/#gather-victim-host-information), [System Service Discovery](/tags/#system-service-discovery), [Query Registry](/tags/#query-registry), [Network Service Scanning](/tags/#network-service-scanning), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Discovery](/tags/#process-discovery), [File and Directory Discovery](/tags/#file-and-directory-discovery), [Software Discovery](/tags/#software-discovery), [Software](/tags/#software), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Network Share Discovery](/tags/#network-share-discovery), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Credentials](/tags/#credentials), [Domain Properties](/tags/#domain-properties), [Network Trust Dependencies](/tags/#network-trust-dependencies), [Account Manipulation](/tags/#account-manipulation), [Vulnerability Scanning](/tags/#vulnerability-scanning), [Process Injection](/tags/#process-injection) | [Defense Evasion](/tags/#defense-evasion) | -| [Windows File Extension and Association Abuse](windows_file_extension_and_association_abuse) | [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [Rundll32](/tags/#rundll32), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) | -| [Windows Log Manipulation](windows_log_manipulation) | [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Impact](/tags/#impact) | -| [Windows Persistence Techniques](windows_persistence_techniques) | [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Establish Accounts](/tags/#establish-accounts), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Rogue Domain Controller](/tags/#rogue-domain-controller), [Domain Policy Modification](/tags/#domain-policy-modification), [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Port Monitors](/tags/#port-monitors), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Application Shimming](/tags/#application-shimming), [Windows Service](/tags/#windows-service), [Scheduled Task](/tags/#scheduled-task), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Persistence](/tags/#persistence) | -| [Windows Privilege Escalation](windows_privilege_escalation) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Accessibility Features](/tags/#accessibility-features), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) | -| [Windows Service Abuse](windows_service_abuse) | [Service Execution](/tags/#service-execution), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Windows Service](/tags/#windows-service) | [Execution](/tags/#execution) | -| [XMRig](xmrig) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping), [Service Stop](/tags/#service-stop), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Account Access Removal](/tags/#account-access-removal), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Software Deployment Tools](/tags/#software-deployment-tools), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Rundll32](/tags/#rundll32), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Defense Evasion](/tags/#defense-evasion) | \ No newline at end of file +| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [Defense Evasion](/tags/#defense-evasion) | +| [Windows Discovery Techniques](windows_discovery_techniques) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Process Injection](/tags/#process-injection), [Hijack Execution Flow](/tags/#hijack-execution-flow) | [Persistence](/tags/#persistence) | +| [Windows File Extension and Association Abuse](windows_file_extension_and_association_abuse) | [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | +| [Windows Log Manipulation](windows_log_manipulation) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) | +| [Windows Persistence Techniques](windows_persistence_techniques) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) | +| [Windows Privilege Escalation](windows_privilege_escalation) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | [Privilege Escalation](/tags/#privilege-escalation) | +| [Windows Service Abuse](windows_service_abuse) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) | +| [XMRig](xmrig) | [Windows Service](/tags/#windows-service) | [Persistence](/tags/#persistence) | \ No newline at end of file diff --git a/docs/_playbooks/ransomware_investigate_and_contain.md b/docs/_playbooks/ransomware_investigate_and_contain.md new file mode 100644 index 0000000000..995e0df85a --- /dev/null +++ b/docs/_playbooks/ransomware_investigate_and_contain.md @@ -0,0 +1,686 @@ +--- +title: "Ransomware Investigate and Contain" +last_modified_at: 2018-02-04 +toc: true +toc_label: "" +tags: + - Response + - Splunk SOAR + - Carbon Black Response + - LDAP + - Palo Alto Networks Firewall + - WildFire + - Cylance +--- + +[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success} + +#### Description + +This playbook investigates and contains ransomware detected on endpoints. + +- **Type**: Response +- **Product**: Splunk SOAR +- **Apps**: [Carbon Black Response](https://splunkbase.splunk.com/apps/#/search/Carbon Black Response/product/soar), [LDAP](https://splunkbase.splunk.com/apps/#/search/LDAP/product/soar), [Palo Alto Networks Firewall](https://splunkbase.splunk.com/apps/#/search/Palo Alto Networks Firewall/product/soar), [WildFire](https://splunkbase.splunk.com/apps/#/search/WildFire/product/soar), [Cylance](https://splunkbase.splunk.com/apps/#/search/Cylance/product/soar) +- **Last Updated**: 2018-02-04 +- **Author**: Philip Royer, Splunk +- **ID**: fc0edc96-ff2b-48b0-9f6f-63da3783fd63 + +#### Associated Detections + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +* [Conti Common Exec parameter](/detections/TTP/conti_common_exec_parameter) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +#### How To Implement +This playbook requires the Splunk SOAR apps for Palo Alto Networks Firewalls, Palo Alto Wildfire, LDAP, and Carbon Black Response. + +#### Playbooks +![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/ransomware_investigate_and_contain.png) + +#### Required field +* ComputerName +* Username + + +#### Reference + + + +[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/ransomware_investigate_and_contain.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md index 556106ddb8..4037afb7b2 100644 --- a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md +++ b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md @@ -5,6 +5,7 @@ categories: - Application last_modified_at: 2017-09-12 toc: true +toc_label: "" tags: - TTP - Splunk Enterprise diff --git a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md index b68d91c14b..ea8f14b561 100644 --- a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md +++ b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2017-09-13 toc: true +toc_label: "" tags: - TTP - Splunk Enterprise diff --git a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md index 9f72db0edb..fbd273a402 100644 --- a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md +++ b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md @@ -5,6 +5,7 @@ categories: - Application last_modified_at: 2017-09-15 toc: true +toc_label: "" tags: - Hunting - Splunk Enterprise diff --git a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md index a607bc5266..29c3160ecb 100644 --- a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md +++ b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md @@ -5,6 +5,7 @@ categories: - Application last_modified_at: 2017-09-19 toc: true +toc_label: "" tags: - Anomaly - Splunk Enterprise diff --git a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md index 71588ed3e3..421938b9e6 100644 --- a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md +++ b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2017-09-20 toc: true +toc_label: "" tags: - Anomaly - T1498.002 @@ -37,8 +38,8 @@ The search is used to identify attempts to use your DNS Infrastructure for DDoS #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1498.002](https://attack.mitre.org/techniques/T1498/002/) | Reflection Amplification | Impact | diff --git a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md index 672853b42f..8842042978 100644 --- a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md @@ -5,6 +5,7 @@ categories: - Web last_modified_at: 2017-09-23 toc: true +toc_label: "" tags: - TTP - T1082 @@ -37,8 +38,8 @@ This search looks for specific GET or HEAD requests to web servers that are indi #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1082](https://attack.mitre.org/techniques/T1082/) | System Information Discovery | Discovery | diff --git a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md index 14a6efb130..aa523dd6aa 100644 --- a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md @@ -5,6 +5,7 @@ categories: - Web last_modified_at: 2017-09-23 toc: true +toc_label: "" tags: - TTP - Splunk Enterprise diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md index 4c6d4cc760..48bbe439f1 100644 --- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md @@ -5,6 +5,7 @@ categories: - Web last_modified_at: 2017-09-23 toc: true +toc_label: "" tags: - TTP - Splunk Enterprise diff --git a/docs/_posts/2017-10-13-unusually_long_content-type_length.md b/docs/_posts/2017-10-13-unusually_long_content-type_length.md index b4a1320beb..91570f4aca 100644 --- a/docs/_posts/2017-10-13-unusually_long_content-type_length.md +++ b/docs/_posts/2017-10-13-unusually_long_content-type_length.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2017-10-13 toc: true +toc_label: "" tags: - Anomaly - Splunk Enterprise diff --git a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md index 1e8a663086..6c2049a08a 100644 --- a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md +++ b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md @@ -5,6 +5,7 @@ categories: - Application last_modified_at: 2018-01-05 toc: true +toc_label: "" tags: - TTP - Splunk Enterprise diff --git a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md index a9274a782e..043d8e0e43 100644 --- a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md +++ b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2018-05-07 toc: true +toc_label: "" tags: - Anomaly - Splunk Enterprise diff --git a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md index 58e237468a..a62f77ff34 100644 --- a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md +++ b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2018-06-01 toc: true +toc_label: "" tags: - TTP - T1095 @@ -37,8 +38,8 @@ This search looks for outbound ICMP packets with a packet size larger than 1,000 #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1095](https://attack.mitre.org/techniques/T1095/) | Non-Application Layer Protocol | Command And Control | diff --git a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md index cbb8500fd7..fd81b707b7 100644 --- a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md +++ b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2018-06-28 toc: true +toc_label: "" tags: - Anomaly - T1530 @@ -36,8 +37,8 @@ This search looks at S3 bucket-access logs and detects new or previously unseen #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection | diff --git a/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md b/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md index 43ceb1ada5..e248c742a2 100644 --- a/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md +++ b/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2018-10-12 toc: true +toc_label: "" tags: - Anomaly - Splunk Security Analytics for AWS diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md index b8b90a48a0..c35cab4b2d 100644 --- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2018-10-23 toc: true +toc_label: "" tags: - TTP - T1047 @@ -36,8 +37,8 @@ This search looks for the creation of WMI permanent event subscriptions. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md index 63fd9a805c..0a3abb9670 100644 --- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2018-10-23 toc: true +toc_label: "" tags: - TTP - T1047 @@ -36,8 +37,8 @@ This search looks for the creation of WMI temporary event subscriptions. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | diff --git a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md index 1470f18adf..93047cff52 100644 --- a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md +++ b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2018-11-27 toc: true +toc_label: "" tags: - Anomaly - T1530 @@ -36,8 +37,8 @@ This search detects users creating spikes in API activity related to deletion of #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection | diff --git a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md index f4bdb0e374..688f0df248 100644 --- a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md +++ b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2018-12-03 toc: true +toc_label: "" tags: - TTP - T1047 @@ -35,8 +36,8 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | diff --git a/docs/_posts/2018-12-03-usn_journal_deletion.md b/docs/_posts/2018-12-03-usn_journal_deletion.md index d0b2c2d65a..c4c816f70c 100644 --- a/docs/_posts/2018-12-03-usn_journal_deletion.md +++ b/docs/_posts/2018-12-03-usn_journal_deletion.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2018-12-03 toc: true +toc_label: "" tags: - TTP - T1070 @@ -35,8 +36,8 @@ The fsutil.exe application is a legitimate Windows utility used to perform tasks #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md index 78e890a386..5544eeead9 100644 --- a/docs/_posts/2018-12-06-suspicious_java_classes.md +++ b/docs/_posts/2018-12-06-suspicious_java_classes.md @@ -5,6 +5,7 @@ categories: - Application last_modified_at: 2018-12-06 toc: true +toc_label: "" tags: - Anomaly - Splunk Enterprise diff --git a/docs/_posts/2018-12-14-file_with_samsam_extension.md b/docs/_posts/2018-12-14-file_with_samsam_extension.md index 361f97f460..8b0f85b3cb 100644 --- a/docs/_posts/2018-12-14-file_with_samsam_extension.md +++ b/docs/_posts/2018-12-14-file_with_samsam_extension.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2018-12-14 toc: true +toc_label: "" tags: - TTP - Splunk Enterprise diff --git a/docs/_posts/2018-12-14-samsam_test_file_write.md b/docs/_posts/2018-12-14-samsam_test_file_write.md index baa6b39280..a8a216de41 100644 --- a/docs/_posts/2018-12-14-samsam_test_file_write.md +++ b/docs/_posts/2018-12-14-samsam_test_file_write.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2018-12-14 toc: true +toc_label: "" tags: - TTP - T1486 @@ -35,8 +36,8 @@ The search looks for a file named "test.txt" written to the windows syst #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact | diff --git a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md index 7d7e1352d4..6ba40c5b92 100644 --- a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md +++ b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2019-01-25 toc: true +toc_label: "" tags: - TTP - Splunk Enterprise diff --git a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md index 41f4701982..1e7b245d09 100644 --- a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md +++ b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md @@ -5,6 +5,7 @@ categories: - Application last_modified_at: 2019-04-01 toc: true +toc_label: "" tags: - TTP - T1082 @@ -37,8 +38,8 @@ This search looks for suspicious processes on all systems labeled as web servers #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1082](https://attack.mitre.org/techniques/T1082/) | System Information Discovery | Discovery | diff --git a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md index 25362c6f7a..22b9535720 100644 --- a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md +++ b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2019-05-08 toc: true +toc_label: "" tags: - Anomaly - Splunk Enterprise diff --git a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md index edba339902..ef5b8d2e16 100644 --- a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md +++ b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2019-12-03 toc: true +toc_label: "" tags: - TTP - T1003.001 @@ -34,8 +35,8 @@ This search looks for reading lsass memory consistent with credential dumping. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access | diff --git a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md index 8200ef30e4..aac20225e9 100644 --- a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md +++ b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2019-12-03 toc: true +toc_label: "" tags: - TTP - T1003.001 @@ -34,8 +35,8 @@ This search looks for reading loaded Images unique to credential dumping with Mi #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access | diff --git a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md index 51f895e8d5..0dd5c25b3b 100644 --- a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md +++ b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2019-12-06 toc: true +toc_label: "" tags: - TTP - T1003.001 @@ -34,8 +35,8 @@ Detect memory dumping of the LSASS process. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access | diff --git a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md index a507d6e374..dd2461a047 100644 --- a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md +++ b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2019-12-06 toc: true +toc_label: "" tags: - TTP - T1003.001 @@ -34,8 +35,8 @@ Detect remote thread creation into LSASS consistent with credential dumping. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access | diff --git a/docs/_posts/2019-12-10-creation_of_shadow_copy.md b/docs/_posts/2019-12-10-creation_of_shadow_copy.md index f6453ef9ed..3e3225f6c1 100644 --- a/docs/_posts/2019-12-10-creation_of_shadow_copy.md +++ b/docs/_posts/2019-12-10-creation_of_shadow_copy.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2019-12-10 toc: true +toc_label: "" tags: - TTP - T1003.003 @@ -35,8 +36,8 @@ Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003.003](https://attack.mitre.org/techniques/T1003/003/) | NTDS | Credential Access | diff --git a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md index ebf3402577..b472f501d5 100644 --- a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md +++ b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2020-01-22 toc: true +toc_label: "" tags: - Anomaly - T1071.004 @@ -37,8 +38,8 @@ This search allows you to identify DNS requests that are unusually large for the #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1071.004](https://attack.mitre.org/techniques/T1071/004/) | DNS | Command And Control | diff --git a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md index a27588f7e0..e00c42e7af 100644 --- a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md +++ b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-02-03 toc: true +toc_label: "" tags: - TTP - T1003.001 @@ -34,8 +35,8 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access | diff --git a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md index 1604b9e647..46991326f3 100644 --- a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md +++ b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-02-07 toc: true +toc_label: "" tags: - TTP - Splunk Enterprise diff --git a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md index a602ee3634..e1fb0a65e7 100644 --- a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md +++ b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-02-20 toc: true +toc_label: "" tags: - Hunting - T1525 @@ -35,8 +36,8 @@ This searches show information on uploaded containers including source user, ima #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1525](https://attack.mitre.org/techniques/T1525/) | Implant Internal Image | Persistence | diff --git a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md index 00f619b4b4..b9e41e7577 100644 --- a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md +++ b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-02-21 toc: true +toc_label: "" tags: - TTP - T1003.001 @@ -35,8 +36,8 @@ Detect the usage of comsvcs.dll for dumping the lsass process. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access | diff --git a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md index 3b67a5c441..26a4d89bf3 100644 --- a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md +++ b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-03-16 toc: true +toc_label: "" tags: - TTP - T1068 @@ -37,8 +38,8 @@ This search looks for child processes of spoolsv.exe. This activity is associate #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md index 12b92b1fe1..5ccaf995e6 100644 --- a/docs/_posts/2020-03-16-detect_rare_executables.md +++ b/docs/_posts/2020-03-16-detect_rare_executables.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-03-16 toc: true +toc_label: "" tags: - Anomaly - Splunk Enterprise diff --git a/docs/_posts/2020-03-16-process_execution_via_wmi.md b/docs/_posts/2020-03-16-process_execution_via_wmi.md index 3da2d73d64..ede91ebc19 100644 --- a/docs/_posts/2020-03-16-process_execution_via_wmi.md +++ b/docs/_posts/2020-03-16-process_execution_via_wmi.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-03-16 toc: true +toc_label: "" tags: - TTP - T1047 @@ -35,8 +36,8 @@ The following analytic identifies `WmiPrvSE.exe` spawning a process. This typica #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | diff --git a/docs/_posts/2020-03-16-script_execution_via_wmi.md b/docs/_posts/2020-03-16-script_execution_via_wmi.md index 319bd1e429..f5b95a9c6d 100644 --- a/docs/_posts/2020-03-16-script_execution_via_wmi.md +++ b/docs/_posts/2020-03-16-script_execution_via_wmi.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-03-16 toc: true +toc_label: "" tags: - TTP - T1047 @@ -35,8 +36,8 @@ This search looks for scripts launched via WMI. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | diff --git a/docs/_posts/2020-03-16-spike_in_file_writes.md b/docs/_posts/2020-03-16-spike_in_file_writes.md index 4c73331d86..27f0088083 100644 --- a/docs/_posts/2020-03-16-spike_in_file_writes.md +++ b/docs/_posts/2020-03-16-spike_in_file_writes.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-03-16 toc: true +toc_label: "" tags: - Anomaly - Splunk Enterprise diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md index cd43da2863..3809fef107 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-04-15 toc: true +toc_label: "" tags: - Hunting - T1526 @@ -36,8 +37,8 @@ This search provides information of unauthenticated requests via user agent, and #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery | diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md index 721970bff1..f0bcff1de2 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-04-15 toc: true +toc_label: "" tags: - Hunting - T1526 @@ -36,8 +37,8 @@ This search provides detection information on unauthenticated requests against K #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery | diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md index 357e6af9c0..163f85d2be 100644 --- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md +++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-05-20 toc: true +toc_label: "" tags: - Anomaly - T1068 @@ -35,8 +36,8 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | diff --git a/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md b/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md index 86347f9621..b15712d1dc 100644 --- a/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md +++ b/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-05-28 toc: true +toc_label: "" tags: - Anomaly - Splunk Security Analytics for AWS diff --git a/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md b/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md index 60de4195df..fd52f3048f 100644 --- a/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md +++ b/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-05-28 toc: true +toc_label: "" tags: - Hunting - Splunk Security Analytics for AWS diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md index ca1fd7c7bd..6e710fc26b 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-06-23 toc: true +toc_label: "" tags: - Hunting - Splunk Enterprise diff --git a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md index 10b3f3c11d..f7b55491b8 100644 --- a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md +++ b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-07-03 toc: true +toc_label: "" tags: - TTP - T1574.009 @@ -37,8 +38,8 @@ The detection Detect Path Interception By Creation Of program exe is detecting t #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1574.009](https://attack.mitre.org/techniques/T1574/009/) | Path Interception by Unquoted Path | Persistence, Privilege Escalation, Defense Evasion | diff --git a/docs/_posts/2020-07-06-short_lived_windows_accounts.md b/docs/_posts/2020-07-06-short_lived_windows_accounts.md index 81cce0ef9b..f7764772c0 100644 --- a/docs/_posts/2020-07-06-short_lived_windows_accounts.md +++ b/docs/_posts/2020-07-06-short_lived_windows_accounts.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-07-06 toc: true +toc_label: "" tags: - TTP - T1136.001 @@ -34,8 +35,8 @@ This search detects accounts that were created and deleted in a short time perio #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1136.001](https://attack.mitre.org/techniques/T1136/001/) | Local Account | Persistence | diff --git a/docs/_posts/2020-07-06-windows_event_log_cleared.md b/docs/_posts/2020-07-06-windows_event_log_cleared.md index 149b925e6a..0450d3d269 100644 --- a/docs/_posts/2020-07-06-windows_event_log_cleared.md +++ b/docs/_posts/2020-07-06-windows_event_log_cleared.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-07-06 toc: true +toc_label: "" tags: - TTP - T1070.001 @@ -34,8 +35,8 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1070.001](https://attack.mitre.org/techniques/T1070/001/) | Clear Windows Event Logs | Defense Evasion | diff --git a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md index 05be4a70f1..138253d43f 100644 --- a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md +++ b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2020-07-07 toc: true +toc_label: "" tags: - Anomaly - T1021.001 @@ -37,8 +38,8 @@ This search looks for network traffic on TCP/3389, the default port used by remo #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement | diff --git a/docs/_posts/2020-07-08-detect_new_local_admin_account.md b/docs/_posts/2020-07-08-detect_new_local_admin_account.md index a4f859d0bd..ca61b02144 100644 --- a/docs/_posts/2020-07-08-detect_new_local_admin_account.md +++ b/docs/_posts/2020-07-08-detect_new_local_admin_account.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-07-08 toc: true +toc_label: "" tags: - TTP - T1136.001 @@ -35,8 +36,8 @@ This search looks for newly created accounts that have been elevated to local ad #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1136.001](https://attack.mitre.org/techniques/T1136/001/) | Local Account | Persistence | diff --git a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md index 4db1d5190b..7d279f7cb4 100644 --- a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md +++ b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-07-17 toc: true +toc_label: "" tags: - Hunting - T1526 @@ -36,8 +37,8 @@ This search provides information of unauthenticated requests via user agent, and #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery | diff --git a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md index c063520361..25b22fe5c6 100644 --- a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md +++ b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - TTP - T1562.001 @@ -36,8 +37,8 @@ This search looks for attempts to stop security-related services on the endpoint #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | diff --git a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md index 225d5cf286..e655b78f98 100644 --- a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md +++ b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - Anomaly - T1078.003 @@ -37,8 +38,8 @@ This search detects user accounts that have been locked out a relatively high nu #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078.003](https://attack.mitre.org/techniques/T1078/003/) | Local Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md index 30c4a798f1..4c00575181 100644 --- a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md +++ b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - TTP - T1071.002 @@ -38,8 +39,8 @@ This search looks for outbound SMB connections made by hosts within your network #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1071.002](https://attack.mitre.org/techniques/T1071/002/) | File Transfer Protocols | Command And Control | diff --git a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md index 31be8b850a..5ddead128c 100644 --- a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md +++ b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - TTP - T1566.001 @@ -37,8 +38,8 @@ This search looks for execution of process `outlook.exe` where the process is wr #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md index 572252c1c4..47aa6a73ac 100644 --- a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md +++ b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - TTP - T1059.003 @@ -35,8 +36,8 @@ This search looks for the execution of the cscript.exe or wscript.exe processes, #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution | diff --git a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md index ca6e6cac03..8a2150aba9 100644 --- a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md +++ b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - TTP - T1072 @@ -39,8 +40,8 @@ This search looks for specific command-line arguments that may indicate the exec #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1072](https://attack.mitre.org/techniques/T1072/) | Software Deployment Tools | Execution, Lateral Movement | diff --git a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md index 0bf3ad523e..a068ff8738 100644 --- a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md +++ b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md @@ -5,6 +5,7 @@ categories: - Application last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - TTP - T1114.001 @@ -37,8 +38,8 @@ The search looks at the change-analysis data model and detects email files creat #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1114.001](https://attack.mitre.org/techniques/T1114/001/) | Local Email Collection | Collection | diff --git a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md index 891cb05adf..ef1a8f7eb1 100644 --- a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md +++ b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md @@ -5,6 +5,7 @@ categories: - Application last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - Anomaly - T1114.002 @@ -37,8 +38,8 @@ This search looks for an increase of data transfers from your email server to yo #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1114.002](https://attack.mitre.org/techniques/T1114/002/) | Remote Email Collection | Collection | diff --git a/docs/_posts/2020-07-21-excessive_dns_failures.md b/docs/_posts/2020-07-21-excessive_dns_failures.md index b31e513d05..e89e6d5791 100644 --- a/docs/_posts/2020-07-21-excessive_dns_failures.md +++ b/docs/_posts/2020-07-21-excessive_dns_failures.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - Anomaly - T1071.004 @@ -37,8 +38,8 @@ This search identifies DNS query failures by counting the number of DNS response #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1071.004](https://attack.mitre.org/techniques/T1071/004/) | DNS | Command And Control | diff --git a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md index 09dad8a390..41dc0d39e6 100644 --- a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md +++ b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - Anomaly - T1569.002 @@ -37,8 +38,8 @@ This search looks for the first and last time a Windows service is seen running #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1569.002](https://attack.mitre.org/techniques/T1569/002/) | Service Execution | Execution | diff --git a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md index 5c7a4841c1..181963f5ca 100644 --- a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md +++ b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - TTP - T1222.001 @@ -35,8 +36,8 @@ Attackers leverage an existing Windows binary, attrib.exe, to mark specific as h #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1222.001](https://attack.mitre.org/techniques/T1222/001/) | Windows File and Directory Permissions Modification | Defense Evasion | diff --git a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md index 30289a551e..3811759cab 100644 --- a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md +++ b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - Anomaly - T1114.002 @@ -37,8 +38,8 @@ This search looks for an increase of data transfers from your email server to yo #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1114.002](https://attack.mitre.org/techniques/T1114/002/) | Remote Email Collection | Collection | diff --git a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md index 99f051639d..db6fdd2803 100644 --- a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md +++ b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - TTP - T1059.001 @@ -36,8 +37,8 @@ This search looks for PowerShell processes started with parameters used to bypas #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | diff --git a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md index 76dc365094..c9fe0ff09c 100644 --- a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md +++ b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md @@ -5,6 +5,7 @@ categories: - Application last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - TTP - T1078.001 @@ -38,8 +39,8 @@ This search detects Okta login failures due to bad credentials for multiple user #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-07-21-okta_account_lockout_events.md b/docs/_posts/2020-07-21-okta_account_lockout_events.md index b63652a07a..a3ffe1effe 100644 --- a/docs/_posts/2020-07-21-okta_account_lockout_events.md +++ b/docs/_posts/2020-07-21-okta_account_lockout_events.md @@ -5,6 +5,7 @@ categories: - Application last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - Anomaly - T1078.001 @@ -38,8 +39,8 @@ Detect Okta user lockout events #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md index c4db59b577..c78d22c437 100644 --- a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md +++ b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md @@ -5,6 +5,7 @@ categories: - Application last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - Anomaly - T1078.001 @@ -38,8 +39,8 @@ Detect failed Okta SSO events #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md index edd186599a..5be788a3f1 100644 --- a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md +++ b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md @@ -5,6 +5,7 @@ categories: - Application last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - Anomaly - T1078.001 @@ -38,8 +39,8 @@ This search detects logins from the same user from different cities in a 24 hour #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md index 0916e6cd0f..9c14a63a65 100644 --- a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md +++ b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - TTP - T1546.008 @@ -36,8 +37,8 @@ Microsoft Windows contains accessibility features that can be launched with a ke #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1546.008](https://attack.mitre.org/techniques/T1546/008/) | Accessibility Features | Privilege Escalation, Persistence | diff --git a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md index 18450c7a09..0a827620c7 100644 --- a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md +++ b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - TTP - T1048 @@ -38,8 +39,8 @@ This search looks for network traffic defined by port and transport layer protoc #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | diff --git a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md index 71397365ca..bb97c0ab6f 100644 --- a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md +++ b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - Anomaly - T1048.003 @@ -37,8 +38,8 @@ This search looks for network traffic on common ports where a higher layer proto #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration | diff --git a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md index e1dba89275..8e972c5485 100644 --- a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md +++ b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - TTP - T1021.001 @@ -38,8 +39,8 @@ This search looks for RDP application network traffic and filters any source/des #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement | diff --git a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md index 0a7469e695..ec8f2a636f 100644 --- a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md +++ b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - Hunting - T1021.001 @@ -37,8 +38,8 @@ This search looks for the remote desktop process mstsc.exe running on systems up #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement | diff --git a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md index 36dda46c06..dfc817ea3b 100644 --- a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md +++ b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - TTP - T1543.003 @@ -36,8 +37,8 @@ This search looks for arguments to sc.exe indicating the creation or modificatio #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation | diff --git a/docs/_posts/2020-07-21-schtasks_scheduling_job_on_remote_system.md b/docs/_posts/2020-07-21-schtasks_scheduling_job_on_remote_system.md index 393c95e3be..a585437fdc 100644 --- a/docs/_posts/2020-07-21-schtasks_scheduling_job_on_remote_system.md +++ b/docs/_posts/2020-07-21-schtasks_scheduling_job_on_remote_system.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - TTP - T1053.005 @@ -37,8 +38,8 @@ This search looks for flags passed to schtasks.exe on the command-line that indi #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation | diff --git a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md index 9b9cb2acb3..7b3b9aab56 100644 --- a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md +++ b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md @@ -5,6 +5,7 @@ categories: - Web last_modified_at: 2020-07-21 toc: true +toc_label: "" tags: - TTP - T1190 @@ -37,8 +38,8 @@ This search looks for long URLs that have several SQL commands visible within th #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | diff --git a/docs/_posts/2020-07-22-smb_traffic_spike.md b/docs/_posts/2020-07-22-smb_traffic_spike.md index cb566e3fa5..6ab1fafba8 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2020-07-22 toc: true +toc_label: "" tags: - Anomaly - T1021.002 @@ -37,8 +38,8 @@ This search looks for spikes in the number of Server Message Block (SMB) traffic #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement | diff --git a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md index 5ba660b4bf..cfda388b41 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2020-07-22 toc: true +toc_label: "" tags: - Anomaly - T1021.002 @@ -37,8 +38,8 @@ This search uses the Machine Learning Toolkit (MLTK) to identify spikes in the n #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement | diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md index 8384d7cff8..c267706c08 100644 --- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md +++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md @@ -5,6 +5,7 @@ categories: - Application last_modified_at: 2020-07-22 toc: true +toc_label: "" tags: - Anomaly - T1566.001 @@ -37,8 +38,8 @@ This search looks for emails that have attachments with suspicious file extensio #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md index 708fb62e49..f21ed117a1 100644 --- a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md +++ b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-07-22 toc: true +toc_label: "" tags: - TTP - T1112 @@ -35,8 +36,8 @@ This search looks for reg.exe being launched from a command prompt not started b #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | diff --git a/docs/_posts/2020-07-22-suspicious_wevtutil_usage.md b/docs/_posts/2020-07-22-suspicious_wevtutil_usage.md index e453a2cdaf..a63febf9b4 100644 --- a/docs/_posts/2020-07-22-suspicious_wevtutil_usage.md +++ b/docs/_posts/2020-07-22-suspicious_wevtutil_usage.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-07-22 toc: true +toc_label: "" tags: - TTP - T1070.001 @@ -35,8 +36,8 @@ The wevtutil.exe application is the windows event log utility. This searches for #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1070.001](https://attack.mitre.org/techniques/T1070/001/) | Clear Windows Event Logs | Defense Evasion | diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md b/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md index cae85f20d4..c40f1300e5 100644 --- a/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md +++ b/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-07-22 toc: true +toc_label: "" tags: - TTP - T1036 @@ -33,8 +34,8 @@ This search detects writes to the recycle bin by a process other than explorer.e #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion | diff --git a/docs/_posts/2020-07-22-tor_traffic.md b/docs/_posts/2020-07-22-tor_traffic.md index ba8c279167..187d77a577 100644 --- a/docs/_posts/2020-07-22-tor_traffic.md +++ b/docs/_posts/2020-07-22-tor_traffic.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2020-07-22 toc: true +toc_label: "" tags: - TTP - T1071.001 @@ -37,8 +38,8 @@ This search looks for network traffic identified as The Onion Router (TOR), a be #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1071.001](https://attack.mitre.org/techniques/T1071/001/) | Web Protocols | Command And Control | diff --git a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md index aa419783fd..bcb6e5def5 100644 --- a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md +++ b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-07-22 toc: true +toc_label: "" tags: - TTP - T1562.001 @@ -35,8 +36,8 @@ Attackers often disable security tools to avoid detection. This search looks for #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | diff --git a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md index 760e1aaaf0..7c9fc50eb6 100644 --- a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md +++ b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-07-27 toc: true +toc_label: "" tags: - Hunting - T1078 @@ -39,8 +40,8 @@ This search provides detection of an user attaching itself to a different role t #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md index d87f558ffd..7d0f124029 100644 --- a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-07-27 toc: true +toc_label: "" tags: - Hunting - T1078 @@ -39,8 +40,8 @@ This search provides detection of accounts creating permanent keys. Permanent ke #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-07-27-aws_detect_role_creation.md b/docs/_posts/2020-07-27-aws_detect_role_creation.md index 5b1bcf4709..ece6c93b0e 100644 --- a/docs/_posts/2020-07-27-aws_detect_role_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_role_creation.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-07-27 toc: true +toc_label: "" tags: - Hunting - T1078 @@ -39,8 +40,8 @@ This search provides detection of role creation by IAM users. Role creation is a #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md index ae49763ef0..43a9307625 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-07-27 toc: true +toc_label: "" tags: - Hunting - T1078 @@ -39,8 +40,8 @@ This search provides detection of suspicious use of sts:AssumeRole. These tokens #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md index 592daf4dd2..e6275dc3f5 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-07-27 toc: true +toc_label: "" tags: - Hunting - T1550 @@ -37,8 +38,8 @@ This search provides detection of suspicious use of sts:GetSessionToken. These t #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1550](https://attack.mitre.org/techniques/T1550/) | Use Alternate Authentication Material | Defense Evasion, Lateral Movement | diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md index 91a036c036..8e10d7f4c4 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2020-07-28 toc: true +toc_label: "" tags: - TTP - T1203 @@ -36,8 +37,8 @@ This search detects SIGRed via Splunk Stream. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1203](https://attack.mitre.org/techniques/T1203/) | Exploitation for Client Execution | Execution | diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md index 88bff75f80..f0e419709d 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2020-07-28 toc: true +toc_label: "" tags: - TTP - T1203 @@ -37,8 +38,8 @@ This search detects SIGRed via Zeek DNS and Zeek Conn data. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1203](https://attack.mitre.org/techniques/T1203/) | Exploitation for Client Execution | Execution | diff --git a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md index a4ac18c337..bedbdf9670 100644 --- a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md +++ b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-07-29 toc: true +toc_label: "" tags: - Anomaly - T1078.004 @@ -38,8 +39,8 @@ This search looks for cloud instances being modified by users who have not previ #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md index 33b656a9dc..5159794ccc 100644 --- a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md +++ b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md @@ -5,6 +5,7 @@ categories: - Web last_modified_at: 2020-08-02 toc: true +toc_label: "" tags: - TTP - T1190 @@ -36,8 +37,8 @@ This search detects remote code exploit attempts on F5 BIG-IP, BIG-IQ, and Traff #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | diff --git a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md index fb8b34f4ec..bc3bfd24d6 100644 --- a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md +++ b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-08-05 toc: true +toc_label: "" tags: - TTP - T1530 @@ -36,8 +37,8 @@ This search looks for GCP PubSub events where a user has created an open/public #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection | diff --git a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md index 6507e315c0..be9d056ca2 100644 --- a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md +++ b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-08-10 toc: true +toc_label: "" tags: - Anomaly - T1530 @@ -36,8 +37,8 @@ This search looks at GCP Storage bucket-access logs and detects new or previousl #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection | diff --git a/docs/_posts/2020-08-11-detect_arp_poisoning.md b/docs/_posts/2020-08-11-detect_arp_poisoning.md index 1e34d67a00..95c57d4f38 100644 --- a/docs/_posts/2020-08-11-detect_arp_poisoning.md +++ b/docs/_posts/2020-08-11-detect_arp_poisoning.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2020-08-11 toc: true +toc_label: "" tags: - TTP - T1200 @@ -45,8 +46,8 @@ By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organiza #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1200](https://attack.mitre.org/techniques/T1200/) | Hardware Additions | Initial Access | | [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact | | [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Credential Access, Collection | diff --git a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md index 086471224c..1955d7bc0e 100644 --- a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md +++ b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2020-08-11 toc: true +toc_label: "" tags: - TTP - T1200 @@ -45,8 +46,8 @@ By enabling DHCP Snooping as a Layer 2 Security measure on the organization' #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1200](https://attack.mitre.org/techniques/T1200/) | Hardware Additions | Initial Access | | [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact | | [T1557](https://attack.mitre.org/techniques/T1557/) | Man-in-the-Middle | Credential Access, Collection | diff --git a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md index 678207095e..fdb4c8e8b8 100644 --- a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md +++ b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-08-16 toc: true +toc_label: "" tags: - Anomaly - T1078 @@ -38,8 +39,8 @@ This search looks for cloud provisioning activities from previously unseen IP ad #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md index 0c0f66ca0c..69436491c3 100644 --- a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md +++ b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-08-16 toc: true +toc_label: "" tags: - Anomaly - T1078 @@ -38,8 +39,8 @@ This search looks for cloud provisioning activities from previously unseen regio #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md index 65fcabdb6d..62faf29186 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-08-21 toc: true +toc_label: "" tags: - Anomaly - T1078.004 @@ -41,8 +42,8 @@ This search finds for the number successfully destroyed cloud instances for ever #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md index b8682f9da6..ee88833afa 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-08-21 toc: true +toc_label: "" tags: - Anomaly - T1078.004 @@ -41,8 +42,8 @@ This search finds for the number successfully created cloud instances for every #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-08-25-more_than_usual_number_of_lolbas_applications_in_short_time_period.md b/docs/_posts/2020-08-25-more_than_usual_number_of_lolbas_applications_in_short_time_period.md index 8642ee8b29..cc25e0ddfb 100644 --- a/docs/_posts/2020-08-25-more_than_usual_number_of_lolbas_applications_in_short_time_period.md +++ b/docs/_posts/2020-08-25-more_than_usual_number_of_lolbas_applications_in_short_time_period.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-08-25 toc: true +toc_label: "" tags: - Anomaly - T1059 @@ -37,8 +38,8 @@ Attacker activity may compromise executing several LOLBAS applications in conjun #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | diff --git a/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md b/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md index 1a4bb50590..552967aa3a 100644 --- a/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md +++ b/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md @@ -5,6 +5,7 @@ categories: - Application last_modified_at: 2020-08-25 toc: true +toc_label: "" tags: - Anomaly - T1566 @@ -34,8 +35,8 @@ Malicious mails can conduct phishing that induces readers to open attachment, cl #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | diff --git a/docs/_posts/2020-08-25-system_process_running_from_unexpected_location.md b/docs/_posts/2020-08-25-system_process_running_from_unexpected_location.md index 6c2f1653e7..74e2e21c02 100644 --- a/docs/_posts/2020-08-25-system_process_running_from_unexpected_location.md +++ b/docs/_posts/2020-08-25-system_process_running_from_unexpected_location.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-08-25 toc: true +toc_label: "" tags: - Anomaly - T1036 @@ -32,8 +33,8 @@ An attacker tries might try to use different version of a system command without #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion | diff --git a/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md b/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md index aae1d82266..fe738a11e4 100644 --- a/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md +++ b/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-09-02 toc: true +toc_label: "" tags: - Anomaly - T1535 @@ -36,8 +37,8 @@ This search looks at cloud-infrastructure events where an instance is created in #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion | diff --git a/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md b/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md index d3cb52200e..4e24ad4d1b 100644 --- a/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md +++ b/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-09-04 toc: true +toc_label: "" tags: - Anomaly - T1078 @@ -38,8 +39,8 @@ This search looks for new commands from each user role. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md index 708fbbd36e..3e97386ca4 100644 --- a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md +++ b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-09-07 toc: true +toc_label: "" tags: - Anomaly - T1078.004 @@ -39,8 +40,8 @@ This search will detect a spike in the number of API calls made to your cloud in #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md index 3e916c4317..15038a00d8 100644 --- a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md +++ b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-09-07 toc: true +toc_label: "" tags: - Anomaly - T1078.004 @@ -39,8 +40,8 @@ This search will detect a spike in the number of API calls made to your cloud in #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md b/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md index 4f88f6e541..8bba8c587f 100644 --- a/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md +++ b/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-09-12 toc: true +toc_label: "" tags: - Anomaly - Splunk Security Analytics for AWS diff --git a/docs/_posts/2020-09-15-detect_dump_lsass_memory_using_comsvcs.md b/docs/_posts/2020-09-15-detect_dump_lsass_memory_using_comsvcs.md index def717cd73..0f433a602c 100644 --- a/docs/_posts/2020-09-15-detect_dump_lsass_memory_using_comsvcs.md +++ b/docs/_posts/2020-09-15-detect_dump_lsass_memory_using_comsvcs.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-09-15 toc: true +toc_label: "" tags: - TTP - T1003.003 @@ -32,8 +33,8 @@ This search detects the memory of lsass.exe being dumped for offline credential #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003.003](https://attack.mitre.org/techniques/T1003/003/) | NTDS | Credential Access | diff --git a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md index e0efb5c68d..9f52d4e126 100644 --- a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md +++ b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2020-09-15 toc: true +toc_label: "" tags: - TTP - T1190 @@ -36,8 +37,8 @@ This search detects attempts to run exploits for the Zerologon CVE-2020-1472 vul #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | diff --git a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md index 9b679eb42f..4bf46032ea 100644 --- a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md +++ b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-09-16 toc: true +toc_label: "" tags: - TTP - T1070.005 @@ -35,8 +36,8 @@ This search looks for the creation or deletion of hidden shares using net.exe. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1070.005](https://attack.mitre.org/techniques/T1070/005/) | Network Share Connection Removal | Defense Evasion | diff --git a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md index 2428fd6df7..e6800fd273 100644 --- a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md +++ b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-09-18 toc: true +toc_label: "" tags: - Hunting - T1210 @@ -34,8 +35,8 @@ This search looks for Event Code 4742 (Computer Change) or EventCode 4624 (An ac #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1210](https://attack.mitre.org/techniques/T1210/) | Exploitation of Remote Services | Lateral Movement | diff --git a/docs/_posts/2020-10-06-unusually_long_command_line.md b/docs/_posts/2020-10-06-unusually_long_command_line.md index 766f2a2814..2d4bf20c39 100644 --- a/docs/_posts/2020-10-06-unusually_long_command_line.md +++ b/docs/_posts/2020-10-06-unusually_long_command_line.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-10-06 toc: true +toc_label: "" tags: - Anomaly - Splunk Behavioral Analytics diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md index 0b81d8b68c..29cba63514 100644 --- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md +++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-10-07 toc: true +toc_label: "" tags: - Hunting - T1535 @@ -36,8 +37,8 @@ This search looks for AWS CloudTrail events wherein a console login event by a u #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion | diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md index 0669a1170a..fb1571941f 100644 --- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md +++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-10-07 toc: true +toc_label: "" tags: - Hunting - T1535 @@ -36,8 +37,8 @@ This search looks for AWS CloudTrail events wherein a console login event by a u #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion | diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md index d08e4231a7..0fb8175068 100644 --- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md +++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-10-07 toc: true +toc_label: "" tags: - Hunting - T1535 @@ -36,8 +37,8 @@ This search looks for AWS CloudTrail events wherein a console login event by a u #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion | diff --git a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md index ba98efddcc..c7ebbb0fe2 100644 --- a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md +++ b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-10-08 toc: true +toc_label: "" tags: - TTP - T1078 @@ -39,8 +40,8 @@ This search provides detection of GCPloit exploitation framework. This framework #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md index 4a30c84a1f..a38325a326 100644 --- a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md +++ b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-10-09 toc: true +toc_label: "" tags: - Anomaly - T1078 @@ -38,8 +39,8 @@ This search looks for cloud provisioning activities from previously unseen citie #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md index f44efbe573..956fb10579 100644 --- a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md +++ b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-10-09 toc: true +toc_label: "" tags: - Anomaly - T1078 @@ -38,8 +39,8 @@ This search looks for cloud provisioning activities from previously unseen count #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md index ff2b977250..78f425286a 100644 --- a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md +++ b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-10-15 toc: true +toc_label: "" tags: - TTP - T1550.002 @@ -35,8 +36,8 @@ This search looks for specific authentication events from the Windows Security E #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1550.002](https://attack.mitre.org/techniques/T1550/002/) | Pass the Hash | Defense Evasion, Lateral Movement | diff --git a/docs/_posts/2020-10-16-kerberoasting_spn_request_with_rc4_encryption.md b/docs/_posts/2020-10-16-kerberoasting_spn_request_with_rc4_encryption.md index ac82511315..c2ab220c76 100644 --- a/docs/_posts/2020-10-16-kerberoasting_spn_request_with_rc4_encryption.md +++ b/docs/_posts/2020-10-16-kerberoasting_spn_request_with_rc4_encryption.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-10-16 toc: true +toc_label: "" tags: - TTP - T1558.003 @@ -34,8 +35,8 @@ This search detects a potential kerberoasting attack via service principal name #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1558.003](https://attack.mitre.org/techniques/T1558/003/) | Kerberoasting | Credential Access | diff --git a/docs/_posts/2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.md b/docs/_posts/2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.md index 272bb040a1..64669e7338 100644 --- a/docs/_posts/2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.md +++ b/docs/_posts/2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-10-18 toc: true +toc_label: "" tags: - TTP - T1003 @@ -32,8 +33,8 @@ Credential extraction is often an illegal recovery of credential material from s #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | diff --git a/docs/_posts/2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.md b/docs/_posts/2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.md index 3065052d3b..44be3585a5 100644 --- a/docs/_posts/2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.md +++ b/docs/_posts/2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-10-18 toc: true +toc_label: "" tags: - TTP - T1003 @@ -32,8 +33,8 @@ Credential extraction is often an illegal recovery of credential material from s #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | diff --git a/docs/_posts/2020-10-18-credential_extraction_indicative_of_lazagne_command_line_options.md b/docs/_posts/2020-10-18-credential_extraction_indicative_of_lazagne_command_line_options.md index cddce9f360..3f9a566d73 100644 --- a/docs/_posts/2020-10-18-credential_extraction_indicative_of_lazagne_command_line_options.md +++ b/docs/_posts/2020-10-18-credential_extraction_indicative_of_lazagne_command_line_options.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-10-18 toc: true +toc_label: "" tags: - TTP - T1003 @@ -35,8 +36,8 @@ Credential extraction is often an illegal recovery of credential material from s #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | | [T1555](https://attack.mitre.org/techniques/T1555/) | Credentials from Password Stores | Credential Access | diff --git a/docs/_posts/2020-10-18-credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.md b/docs/_posts/2020-10-18-credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.md index d43a977d48..43f5107674 100644 --- a/docs/_posts/2020-10-18-credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.md +++ b/docs/_posts/2020-10-18-credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-10-18 toc: true +toc_label: "" tags: - TTP - T1003 @@ -32,8 +33,8 @@ Credential extraction is often an illegal recovery of credential material from s #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | diff --git a/docs/_posts/2020-10-18-credential_extraction_native_microsoft_debuggers_via_z_command_line_option.md b/docs/_posts/2020-10-18-credential_extraction_native_microsoft_debuggers_via_z_command_line_option.md index f6e3948c87..6e199e61b5 100644 --- a/docs/_posts/2020-10-18-credential_extraction_native_microsoft_debuggers_via_z_command_line_option.md +++ b/docs/_posts/2020-10-18-credential_extraction_native_microsoft_debuggers_via_z_command_line_option.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-10-18 toc: true +toc_label: "" tags: - TTP - T1003 @@ -32,8 +33,8 @@ Credential extraction is often an illegal recovery of credential material from s #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | diff --git a/docs/_posts/2020-10-18-credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.md b/docs/_posts/2020-10-18-credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.md index a2a4b68246..f5f648c5b5 100644 --- a/docs/_posts/2020-10-18-credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.md +++ b/docs/_posts/2020-10-18-credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-10-18 toc: true +toc_label: "" tags: - TTP - T1003 @@ -32,8 +33,8 @@ Credential extraction is often an illegal recovery of credential material from s #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | diff --git a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.md b/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.md index e5f4bf4fd7..12015f69df 100644 --- a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.md +++ b/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-10-21 toc: true +toc_label: "" tags: - TTP - T1003 @@ -32,8 +33,8 @@ Credential extraction is often an illegal recovery of credential material from s #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | diff --git a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_modules.md b/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_modules.md index c09f4b9329..67aaac4bc3 100644 --- a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_modules.md +++ b/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-10-21 toc: true +toc_label: "" tags: - TTP - T1003 @@ -32,8 +33,8 @@ Credential extraction is often an illegal recovery of credential material from s #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | diff --git a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_mimikatz_modules.md b/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_mimikatz_modules.md index 46ea44263b..a6ba5aea9a 100644 --- a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_mimikatz_modules.md +++ b/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_mimikatz_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-10-21 toc: true +toc_label: "" tags: - TTP - T1003 @@ -32,8 +33,8 @@ Credential extraction is often an illegal recovery of credential material from s #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | diff --git a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_powersploit_modules.md b/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_powersploit_modules.md index f1f2a4dfc1..4832fb8997 100644 --- a/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_powersploit_modules.md +++ b/docs/_posts/2020-10-21-credential_extraction_indicative_of_use_of_powersploit_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-10-21 toc: true +toc_label: "" tags: - TTP - T1003 @@ -32,8 +33,8 @@ Credential extraction is often an illegal recovery of credential material from s #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | diff --git a/docs/_posts/2020-10-21-detect_kerberoasting.md b/docs/_posts/2020-10-21-detect_kerberoasting.md index 1a38e87e68..ad7bdb92f9 100644 --- a/docs/_posts/2020-10-21-detect_kerberoasting.md +++ b/docs/_posts/2020-10-21-detect_kerberoasting.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-10-21 toc: true +toc_label: "" tags: - TTP - T1558.003 @@ -32,8 +33,8 @@ This search detects a potential kerberoasting attack via service principal name #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1558.003](https://attack.mitre.org/techniques/T1558/003/) | Kerberoasting | Credential Access | diff --git a/docs/_posts/2020-10-21-detect_pass_the_hash.md b/docs/_posts/2020-10-21-detect_pass_the_hash.md index 55e65dd5d0..389eb0646c 100644 --- a/docs/_posts/2020-10-21-detect_pass_the_hash.md +++ b/docs/_posts/2020-10-21-detect_pass_the_hash.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-10-21 toc: true +toc_label: "" tags: - TTP - T1550.002 @@ -33,8 +34,8 @@ This search looks for specific authentication events from the Windows Security E #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1550.002](https://attack.mitre.org/techniques/T1550/002/) | Pass the Hash | Defense Evasion, Lateral Movement | diff --git a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md index c4089c7f52..f2abdf6db1 100644 --- a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md +++ b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2020-10-21 toc: true +toc_label: "" tags: - TTP - T1041 @@ -36,8 +37,8 @@ This search looks for commands that the SNICat tool uses in the TLS SNI field. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1041](https://attack.mitre.org/techniques/T1041/) | Exfiltration Over C2 Channel | Exfiltration | diff --git a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md index 584b70a946..f85bd65eb2 100644 --- a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md +++ b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2020-10-28 toc: true +toc_label: "" tags: - TTP - T1200 @@ -45,8 +46,8 @@ By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organiz #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1200](https://attack.mitre.org/techniques/T1200/) | Hardware Additions | Initial Access | | [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact | | [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Credential Access, Collection | diff --git a/docs/_posts/2020-10-28-detect_port_security_violation.md b/docs/_posts/2020-10-28-detect_port_security_violation.md index a28fbca767..515c59d108 100644 --- a/docs/_posts/2020-10-28-detect_port_security_violation.md +++ b/docs/_posts/2020-10-28-detect_port_security_violation.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2020-10-28 toc: true +toc_label: "" tags: - TTP - T1200 @@ -46,8 +47,8 @@ By enabling Port Security on a Cisco switch you can restrict input to an interfa #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1200](https://attack.mitre.org/techniques/T1200/) | Hardware Additions | Initial Access | | [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact | | [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Credential Access, Collection | diff --git a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md index a922af4344..98f1c25a75 100644 --- a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md +++ b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2020-10-28 toc: true +toc_label: "" tags: - TTP - T1542.005 @@ -38,8 +39,8 @@ Adversaries may abuse netbooting to load an unauthorized network device operatin #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1542.005](https://attack.mitre.org/techniques/T1542/005/) | TFTP Boot | Defense Evasion, Persistence | diff --git a/docs/_posts/2020-10-28-detect_traffic_mirroring.md b/docs/_posts/2020-10-28-detect_traffic_mirroring.md index 441b132fc5..aa217e4911 100644 --- a/docs/_posts/2020-10-28-detect_traffic_mirroring.md +++ b/docs/_posts/2020-10-28-detect_traffic_mirroring.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2020-10-28 toc: true +toc_label: "" tags: - TTP - T1200 @@ -43,8 +44,8 @@ Adversaries may leverage traffic mirroring in order to automate data exfiltratio #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1200](https://attack.mitre.org/techniques/T1200/) | Hardware Additions | Initial Access | | [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact | | [T1020.001](https://attack.mitre.org/techniques/T1020/001/) | Traffic Duplication | Exfiltration | diff --git a/docs/_posts/2020-11-03-applying_stolen_credentials_via_mimikatz_modules.md b/docs/_posts/2020-11-03-applying_stolen_credentials_via_mimikatz_modules.md index e80326678a..23b4f5daf6 100644 --- a/docs/_posts/2020-11-03-applying_stolen_credentials_via_mimikatz_modules.md +++ b/docs/_posts/2020-11-03-applying_stolen_credentials_via_mimikatz_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-03 toc: true +toc_label: "" tags: - TTP - T1055 @@ -72,8 +73,8 @@ This detection indicates use of Mimikatz modules that facilitate Pass-the-Token #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-11-03-applying_stolen_credentials_via_powersploit_modules.md b/docs/_posts/2020-11-03-applying_stolen_credentials_via_powersploit_modules.md index 0a7076405f..39a3f70f27 100644 --- a/docs/_posts/2020-11-03-applying_stolen_credentials_via_powersploit_modules.md +++ b/docs/_posts/2020-11-03-applying_stolen_credentials_via_powersploit_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-03 toc: true +toc_label: "" tags: - TTP - T1055 @@ -70,8 +71,8 @@ Stolen credentials are applied by methods such as user impersonation, credential #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-11-03-assessment_of_credential_strength_via_dsinternals_modules.md b/docs/_posts/2020-11-03-assessment_of_credential_strength_via_dsinternals_modules.md index 965b558b1d..60f7de1d18 100644 --- a/docs/_posts/2020-11-03-assessment_of_credential_strength_via_dsinternals_modules.md +++ b/docs/_posts/2020-11-03-assessment_of_credential_strength_via_dsinternals_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-03 toc: true +toc_label: "" tags: - TTP - T1078 @@ -50,8 +51,8 @@ This detection identifies use of DSInternals modules that verify password streng #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | diff --git a/docs/_posts/2020-11-03-reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.md b/docs/_posts/2020-11-03-reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.md index 95fa4de3f6..39d95afda0 100644 --- a/docs/_posts/2020-11-03-reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.md +++ b/docs/_posts/2020-11-03-reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-03 toc: true +toc_label: "" tags: - TTP - T1589.001 @@ -50,8 +51,8 @@ This detection identifies reconnaissance of credential stores and use of CryptoA #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1589.001](https://attack.mitre.org/techniques/T1589/001/) | Credentials | Reconnaissance || [T1590.001](https://attack.mitre.org/techniques/T1590/001/) | Domain Properties | Reconnaissance || [T1590.003](https://attack.mitre.org/techniques/T1590/003/) | Network Trust Dependencies | Reconnaissance || [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | diff --git a/docs/_posts/2020-11-03-setting_credentials_via_dsinternals_modules.md b/docs/_posts/2020-11-03-setting_credentials_via_dsinternals_modules.md index b527731215..3ae4e021cc 100644 --- a/docs/_posts/2020-11-03-setting_credentials_via_dsinternals_modules.md +++ b/docs/_posts/2020-11-03-setting_credentials_via_dsinternals_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-03 toc: true +toc_label: "" tags: - TTP - T1068 @@ -41,8 +42,8 @@ This detection identifies illegal setting of credentials via DSInternals modules #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | diff --git a/docs/_posts/2020-11-03-setting_credentials_via_mimikatz_modules.md b/docs/_posts/2020-11-03-setting_credentials_via_mimikatz_modules.md index c831bd8ee8..eb4f5de639 100644 --- a/docs/_posts/2020-11-03-setting_credentials_via_mimikatz_modules.md +++ b/docs/_posts/2020-11-03-setting_credentials_via_mimikatz_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-03 toc: true +toc_label: "" tags: - TTP - T1068 @@ -41,8 +42,8 @@ This detection identifies illegal setting of credentials via Mimikatz modules. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | diff --git a/docs/_posts/2020-11-03-setting_credentials_via_powersploit_modules.md b/docs/_posts/2020-11-03-setting_credentials_via_powersploit_modules.md index 4fcd3dbb26..e035e2e1a6 100644 --- a/docs/_posts/2020-11-03-setting_credentials_via_powersploit_modules.md +++ b/docs/_posts/2020-11-03-setting_credentials_via_powersploit_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-03 toc: true +toc_label: "" tags: - TTP - T1068 @@ -41,8 +42,8 @@ This detection identifies illegal setting of credentials via PowerSploit modules #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | diff --git a/docs/_posts/2020-11-04-probing_access_with_stolen_credentials_via_powersploit_modules.md b/docs/_posts/2020-11-04-probing_access_with_stolen_credentials_via_powersploit_modules.md index 09254f96e8..1a4db9abba 100644 --- a/docs/_posts/2020-11-04-probing_access_with_stolen_credentials_via_powersploit_modules.md +++ b/docs/_posts/2020-11-04-probing_access_with_stolen_credentials_via_powersploit_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-04 toc: true +toc_label: "" tags: - TTP - T1078 @@ -38,8 +39,8 @@ This detection identifies use of PowerSploit modules that facilitate access prob #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | diff --git a/docs/_posts/2020-11-05-reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.md b/docs/_posts/2020-11-05-reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.md index 8a96ce92c7..62a5c4a81e 100644 --- a/docs/_posts/2020-11-05-reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.md +++ b/docs/_posts/2020-11-05-reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-05 toc: true +toc_label: "" tags: - TTP - T1078 @@ -42,8 +43,8 @@ This detection identifies use of Mimikatz modules for discovery of accounts and #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | | [T1484](https://attack.mitre.org/techniques/T1484/) | Domain Policy Modification | Defense Evasion, Privilege Escalation | diff --git a/docs/_posts/2020-11-05-reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.md b/docs/_posts/2020-11-05-reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.md index aab4c1b219..ab50e886a3 100644 --- a/docs/_posts/2020-11-05-reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.md +++ b/docs/_posts/2020-11-05-reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-05 toc: true +toc_label: "" tags: - TTP - T1078 @@ -42,8 +43,8 @@ This detection identifies access to PowerSploit modules that discover accounts, #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | | [T1484](https://attack.mitre.org/techniques/T1484/) | Domain Policy Modification | Defense Evasion, Privilege Escalation | diff --git a/docs/_posts/2020-11-05-reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.md b/docs/_posts/2020-11-05-reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.md index 068a862ab5..bb05309a66 100644 --- a/docs/_posts/2020-11-05-reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.md +++ b/docs/_posts/2020-11-05-reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-05 toc: true +toc_label: "" tags: - TTP - T1053 @@ -56,8 +57,8 @@ This detection identifies use of PowerSploit modules that discover opportunities #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-11-05-reconnaissance_of_defensive_tools_via_powersploit_modules.md b/docs/_posts/2020-11-05-reconnaissance_of_defensive_tools_via_powersploit_modules.md index 39459b565c..2629b4a341 100644 --- a/docs/_posts/2020-11-05-reconnaissance_of_defensive_tools_via_powersploit_modules.md +++ b/docs/_posts/2020-11-05-reconnaissance_of_defensive_tools_via_powersploit_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-05 toc: true +toc_label: "" tags: - TTP - T1595.002 @@ -35,8 +36,8 @@ This detection identifies use of PowerSploit modules for assessment of presence #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1595.002](https://attack.mitre.org/techniques/T1595/002/) | Vulnerability Scanning | Reconnaissance || [T1592.002](https://attack.mitre.org/techniques/T1592/002/) | Software | Reconnaissance | diff --git a/docs/_posts/2020-11-05-reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.md b/docs/_posts/2020-11-05-reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.md index 8261d4ac84..877afb4b8a 100644 --- a/docs/_posts/2020-11-05-reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.md +++ b/docs/_posts/2020-11-05-reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-05 toc: true +toc_label: "" tags: - TTP - T1068 @@ -41,8 +42,8 @@ This detection identifies use of PowerSploit modules for assessment of privilege #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | diff --git a/docs/_posts/2020-11-05-reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.md b/docs/_posts/2020-11-05-reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.md index e0ec78daba..24732d28f2 100644 --- a/docs/_posts/2020-11-05-reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.md +++ b/docs/_posts/2020-11-05-reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-05 toc: true +toc_label: "" tags: - TTP - T1543 @@ -42,8 +43,8 @@ This detection identifies use of Mimikatz modules for discovery of process or se #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | | [T1574](https://attack.mitre.org/techniques/T1574/) | Hijack Execution Flow | Persistence, Privilege Escalation, Defense Evasion | diff --git a/docs/_posts/2020-11-06-reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.md b/docs/_posts/2020-11-06-reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.md index b9a9c4587a..dd02ff9b3f 100644 --- a/docs/_posts/2020-11-06-reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.md +++ b/docs/_posts/2020-11-06-reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-06 toc: true +toc_label: "" tags: - TTP - T1199 @@ -44,8 +45,8 @@ This detection identifies access to PowerSploit modules for reconnaissance and a #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1199](https://attack.mitre.org/techniques/T1199/) | Trusted Relationship | Initial Access | | [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | | [T1590](https://attack.mitre.org/techniques/T1590/) | Gather Victim Network Information | Reconnaissance | diff --git a/docs/_posts/2020-11-06-reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.md b/docs/_posts/2020-11-06-reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.md index c6e1cb71a1..278d0bdc91 100644 --- a/docs/_posts/2020-11-06-reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.md +++ b/docs/_posts/2020-11-06-reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-06 toc: true +toc_label: "" tags: - TTP - T1592 @@ -38,8 +39,8 @@ This detection identifies access to PowerSploit modules that discover computers, #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance | | [T1590](https://attack.mitre.org/techniques/T1590/) | Gather Victim Network Information | Reconnaissance | | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | diff --git a/docs/_posts/2020-11-06-reconnaissance_and_access_to_computers_via_mimikatz_modules.md b/docs/_posts/2020-11-06-reconnaissance_and_access_to_computers_via_mimikatz_modules.md index ca02488efa..316dc1ba0d 100644 --- a/docs/_posts/2020-11-06-reconnaissance_and_access_to_computers_via_mimikatz_modules.md +++ b/docs/_posts/2020-11-06-reconnaissance_and_access_to_computers_via_mimikatz_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-06 toc: true +toc_label: "" tags: - TTP - T1592 @@ -32,8 +33,8 @@ This detection identifies use of Mimikatz modules for discovery of computers and #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance | diff --git a/docs/_posts/2020-11-06-reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.md b/docs/_posts/2020-11-06-reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.md index 53928039af..cec9d87542 100644 --- a/docs/_posts/2020-11-06-reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.md +++ b/docs/_posts/2020-11-06-reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-06 toc: true +toc_label: "" tags: - TTP - T1007 @@ -53,8 +54,8 @@ This detection identifies access to PowerSploit modules that discover and access #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1007](https://attack.mitre.org/techniques/T1007/) | System Service Discovery | Discovery | | [T1012](https://attack.mitre.org/techniques/T1012/) | Query Registry | Discovery | | [T1046](https://attack.mitre.org/techniques/T1046/) | Network Service Scanning | Discovery | diff --git a/docs/_posts/2020-11-06-reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.md b/docs/_posts/2020-11-06-reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.md index d46142798e..815870cb27 100644 --- a/docs/_posts/2020-11-06-reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.md +++ b/docs/_posts/2020-11-06-reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-06 toc: true +toc_label: "" tags: - TTP - T1007 @@ -38,8 +39,8 @@ This detection identifies use of Mimikatz modules for discovery and access to se #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1007](https://attack.mitre.org/techniques/T1007/) | System Service Discovery | Discovery | | [T1046](https://attack.mitre.org/techniques/T1046/) | Network Service Scanning | Discovery | | [T1057](https://attack.mitre.org/techniques/T1057/) | Process Discovery | Discovery | diff --git a/docs/_posts/2020-11-06-reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.md b/docs/_posts/2020-11-06-reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.md index cb8cffc416..3b6b05a2d5 100644 --- a/docs/_posts/2020-11-06-reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.md +++ b/docs/_posts/2020-11-06-reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-06 toc: true +toc_label: "" tags: - TTP - T1021.002 @@ -38,8 +39,8 @@ This detection identifies use of Mimikatz modules for discovery and access to ne #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement || [T1135](https://attack.mitre.org/techniques/T1135/) | Network Share Discovery | Discovery | | [T1039](https://attack.mitre.org/techniques/T1039/) | Data from Network Shared Drive | Collection | diff --git a/docs/_posts/2020-11-06-reconnaissance_and_access_to_shared_resources_via_powersploit_modules.md b/docs/_posts/2020-11-06-reconnaissance_and_access_to_shared_resources_via_powersploit_modules.md index 1f85ff4606..be82b6a29a 100644 --- a/docs/_posts/2020-11-06-reconnaissance_and_access_to_shared_resources_via_powersploit_modules.md +++ b/docs/_posts/2020-11-06-reconnaissance_and_access_to_shared_resources_via_powersploit_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-06 toc: true +toc_label: "" tags: - TTP - T1021.002 @@ -38,8 +39,8 @@ This detection identifies access to PowerSploit modules that discover and access #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement || [T1135](https://attack.mitre.org/techniques/T1135/) | Network Share Discovery | Discovery | | [T1039](https://attack.mitre.org/techniques/T1039/) | Data from Network Shared Drive | Collection | diff --git a/docs/_posts/2020-11-06-reconnaissance_of_connectivity_via_powersploit_modules.md b/docs/_posts/2020-11-06-reconnaissance_of_connectivity_via_powersploit_modules.md index e57afbc767..bea7096276 100644 --- a/docs/_posts/2020-11-06-reconnaissance_of_connectivity_via_powersploit_modules.md +++ b/docs/_posts/2020-11-06-reconnaissance_of_connectivity_via_powersploit_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-06 toc: true +toc_label: "" tags: - TTP - T1021.002 @@ -38,8 +39,8 @@ This detection identifies access to PowerSploit modules for reconnaissance of co #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement || [T1135](https://attack.mitre.org/techniques/T1135/) | Network Share Discovery | Discovery | | [T1039](https://attack.mitre.org/techniques/T1039/) | Data from Network Shared Drive | Collection | diff --git a/docs/_posts/2020-11-06-ryuk_test_files_detected.md b/docs/_posts/2020-11-06-ryuk_test_files_detected.md index 8d03bf0323..b9a79c6b11 100644 --- a/docs/_posts/2020-11-06-ryuk_test_files_detected.md +++ b/docs/_posts/2020-11-06-ryuk_test_files_detected.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-06 toc: true +toc_label: "" tags: - TTP - T1486 @@ -34,8 +35,8 @@ The search looks for files that contain the key word *Ryuk* under any folder in #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact | diff --git a/docs/_posts/2020-11-06-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md b/docs/_posts/2020-11-06-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md index 403492a03c..12ca5e06eb 100644 --- a/docs/_posts/2020-11-06-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md +++ b/docs/_posts/2020-11-06-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-06 toc: true +toc_label: "" tags: - TTP - T1059.001 @@ -36,8 +37,8 @@ Monitor for changes of the ExecutionPolicy in the registry to the values "un #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | diff --git a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md index 52a402d30d..0cb9a5fa87 100644 --- a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md +++ b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-06 toc: true +toc_label: "" tags: - TTP - T1489 @@ -34,8 +35,8 @@ The search looks for a Windows Security Account Manager (SAM) was stopped via co #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact | diff --git a/docs/_posts/2020-11-09-common_ransomware_extensions.md b/docs/_posts/2020-11-09-common_ransomware_extensions.md index a4500211a9..716154a133 100644 --- a/docs/_posts/2020-11-09-common_ransomware_extensions.md +++ b/docs/_posts/2020-11-09-common_ransomware_extensions.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-09 toc: true +toc_label: "" tags: - Hunting - T1485 @@ -35,8 +36,8 @@ The search looks for file modifications with extensions commonly used by Ransomw #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1485](https://attack.mitre.org/techniques/T1485/) | Data Destruction | Impact | diff --git a/docs/_posts/2020-11-09-common_ransomware_notes.md b/docs/_posts/2020-11-09-common_ransomware_notes.md index e9d7a7fb99..f433947dfd 100644 --- a/docs/_posts/2020-11-09-common_ransomware_notes.md +++ b/docs/_posts/2020-11-09-common_ransomware_notes.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-09 toc: true +toc_label: "" tags: - Hunting - T1485 @@ -35,8 +36,8 @@ The search looks for files created with names matching those typically used in r #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1485](https://attack.mitre.org/techniques/T1485/) | Data Destruction | Impact | diff --git a/docs/_posts/2020-11-09-deleting_shadow_copies.md b/docs/_posts/2020-11-09-deleting_shadow_copies.md index 427f3d9c72..e6b909b9a0 100644 --- a/docs/_posts/2020-11-09-deleting_shadow_copies.md +++ b/docs/_posts/2020-11-09-deleting_shadow_copies.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-09 toc: true +toc_label: "" tags: - TTP - T1490 @@ -35,8 +36,8 @@ The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | diff --git a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md index d5feaefe73..1497ba7b73 100644 --- a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md +++ b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-09 toc: true +toc_label: "" tags: - Anomaly - T1078.002 @@ -37,8 +38,8 @@ This search identifies endpoints that have caused a relatively high number of ac #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2020-11-09-illegal_access_to_user_content_via_powersploit_modules.md b/docs/_posts/2020-11-09-illegal_access_to_user_content_via_powersploit_modules.md index 69dbf140db..4623f3153c 100644 --- a/docs/_posts/2020-11-09-illegal_access_to_user_content_via_powersploit_modules.md +++ b/docs/_posts/2020-11-09-illegal_access_to_user_content_via_powersploit_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-09 toc: true +toc_label: "" tags: - TTP - T1021 @@ -41,8 +42,8 @@ This detection identifies access to PowerSploit modules that enable illegaly acc #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | | [T1113](https://attack.mitre.org/techniques/T1113/) | Screen Capture | Collection | | [T1123](https://attack.mitre.org/techniques/T1123/) | Audio Capture | Collection | diff --git a/docs/_posts/2020-11-09-illegal_account_creation_via_powersploit_modules.md b/docs/_posts/2020-11-09-illegal_account_creation_via_powersploit_modules.md index 0090f261bd..1472c90b3b 100644 --- a/docs/_posts/2020-11-09-illegal_account_creation_via_powersploit_modules.md +++ b/docs/_posts/2020-11-09-illegal_account_creation_via_powersploit_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-09 toc: true +toc_label: "" tags: - TTP - T1585 @@ -32,8 +33,8 @@ This detection identifies access to PowerSploit modules that create accounts ill #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1585](https://attack.mitre.org/techniques/T1585/) | Establish Accounts | Resource Development | diff --git a/docs/_posts/2020-11-09-illegal_deletion_of_logs_via_mimikatz_modules.md b/docs/_posts/2020-11-09-illegal_deletion_of_logs_via_mimikatz_modules.md index dce2a4c330..6886b2e79d 100644 --- a/docs/_posts/2020-11-09-illegal_deletion_of_logs_via_mimikatz_modules.md +++ b/docs/_posts/2020-11-09-illegal_deletion_of_logs_via_mimikatz_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-09 toc: true +toc_label: "" tags: - TTP - T1070 @@ -32,8 +33,8 @@ This detection identifies access to PowerSploit modules that delete event logs. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | diff --git a/docs/_posts/2020-11-09-illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.md b/docs/_posts/2020-11-09-illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.md index fc848cbb83..552d7e71a8 100644 --- a/docs/_posts/2020-11-09-illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.md +++ b/docs/_posts/2020-11-09-illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-09 toc: true +toc_label: "" tags: - TTP - T1078 @@ -38,8 +39,8 @@ This detection identifies use of DSInternals modules that enable or disable acco #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | diff --git a/docs/_posts/2020-11-09-illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.md b/docs/_posts/2020-11-09-illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.md index 0425f92a38..8cd17d4133 100644 --- a/docs/_posts/2020-11-09-illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.md +++ b/docs/_posts/2020-11-09-illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-09 toc: true +toc_label: "" tags: - TTP - T1098 @@ -39,8 +40,8 @@ This detection identifies use of DSInternals modules for illegal management of A #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | | [T1207](https://attack.mitre.org/techniques/T1207/) | Rogue Domain Controller | Defense Evasion | | [T1484](https://attack.mitre.org/techniques/T1484/) | Domain Policy Modification | Defense Evasion, Privilege Escalation | diff --git a/docs/_posts/2020-11-09-illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.md b/docs/_posts/2020-11-09-illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.md index 6b9f0c4cb5..6420b2124f 100644 --- a/docs/_posts/2020-11-09-illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.md +++ b/docs/_posts/2020-11-09-illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-09 toc: true +toc_label: "" tags: - TTP - T1098 @@ -39,8 +40,8 @@ This detection identifies access to PowerSploit modules that enable illegal mana #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | | [T1207](https://attack.mitre.org/techniques/T1207/) | Rogue Domain Controller | Defense Evasion | | [T1484](https://attack.mitre.org/techniques/T1484/) | Domain Policy Modification | Defense Evasion, Privilege Escalation | diff --git a/docs/_posts/2020-11-09-illegal_privilege_elevation_and_persistence_via_powersploit_modules.md b/docs/_posts/2020-11-09-illegal_privilege_elevation_and_persistence_via_powersploit_modules.md index 9074e59c4f..7675b82eea 100644 --- a/docs/_posts/2020-11-09-illegal_privilege_elevation_and_persistence_via_powersploit_modules.md +++ b/docs/_posts/2020-11-09-illegal_privilege_elevation_and_persistence_via_powersploit_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-09 toc: true +toc_label: "" tags: - TTP - T1053 @@ -42,8 +43,8 @@ This detection identifies access to PowerSploit modules that illegaly elevate ge #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | | [T1134](https://attack.mitre.org/techniques/T1134/) | Access Token Manipulation | Defense Evasion, Privilege Escalation | | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | diff --git a/docs/_posts/2020-11-09-illegal_privilege_elevation_via_mimikatz_modules.md b/docs/_posts/2020-11-09-illegal_privilege_elevation_via_mimikatz_modules.md index 08213fd3dc..b69a3f990f 100644 --- a/docs/_posts/2020-11-09-illegal_privilege_elevation_via_mimikatz_modules.md +++ b/docs/_posts/2020-11-09-illegal_privilege_elevation_via_mimikatz_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-09 toc: true +toc_label: "" tags: - TTP - T1134 @@ -37,8 +38,8 @@ This detection identifies use of Mimikatz modules for illegal privilege elevatio #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1134](https://attack.mitre.org/techniques/T1134/) | Access Token Manipulation | Defense Evasion, Privilege Escalation | | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | diff --git a/docs/_posts/2020-11-09-illegal_service_and_process_control_via_mimikatz_modules.md b/docs/_posts/2020-11-09-illegal_service_and_process_control_via_mimikatz_modules.md index dfb562de92..91cb0cca10 100644 --- a/docs/_posts/2020-11-09-illegal_service_and_process_control_via_mimikatz_modules.md +++ b/docs/_posts/2020-11-09-illegal_service_and_process_control_via_mimikatz_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-09 toc: true +toc_label: "" tags: - TTP - T1055 @@ -39,8 +40,8 @@ This detection identifies use of Mimikatz modules for illegal control over servi #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | | [T1106](https://attack.mitre.org/techniques/T1106/) | Native API | Execution | | [T1569](https://attack.mitre.org/techniques/T1569/) | System Services | Execution | diff --git a/docs/_posts/2020-11-09-illegal_service_and_process_control_via_powersploit_modules.md b/docs/_posts/2020-11-09-illegal_service_and_process_control_via_powersploit_modules.md index d47c6fa1e7..fa190f83ba 100644 --- a/docs/_posts/2020-11-09-illegal_service_and_process_control_via_powersploit_modules.md +++ b/docs/_posts/2020-11-09-illegal_service_and_process_control_via_powersploit_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-09 toc: true +toc_label: "" tags: - TTP - T1055 @@ -39,8 +40,8 @@ This detection identifies access to PowerSploit modules that enable illegal cont #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | | [T1106](https://attack.mitre.org/techniques/T1106/) | Native API | Execution | | [T1569](https://attack.mitre.org/techniques/T1569/) | System Services | Execution | diff --git a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md index d6fc448a16..53eaf1d1c4 100644 --- a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md +++ b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-10 toc: true +toc_label: "" tags: - TTP - T1016 @@ -37,8 +38,8 @@ This search looks for fast execution of processes used for system network config #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1016](https://attack.mitre.org/techniques/T1016/) | System Network Configuration Discovery | Discovery | diff --git a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md index 5b1f793287..fade550c78 100644 --- a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md +++ b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-10 toc: true +toc_label: "" tags: - Hunting - T1059.003 @@ -35,8 +36,8 @@ This search looks for executions of cmd.exe spawned by a process that is often a #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution | diff --git a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md index 73794d2153..c16e985b56 100644 --- a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md +++ b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-18 toc: true +toc_label: "" tags: - TTP - T1548.002 @@ -35,8 +36,8 @@ The search looks for modifications to registry keys that control the enforcement #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Privilege Escalation, Defense Evasion | diff --git a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md index bcf5f9db6c..cada006e31 100644 --- a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md +++ b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-18 toc: true +toc_label: "" tags: - TTP - T1036.003 @@ -35,8 +36,8 @@ This search looks for processes launched from files that have double extensions #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | diff --git a/docs/_posts/2020-11-23-monitor_registry_keys_for_print_monitors.md b/docs/_posts/2020-11-23-monitor_registry_keys_for_print_monitors.md index eb9404d91c..6a3611b622 100644 --- a/docs/_posts/2020-11-23-monitor_registry_keys_for_print_monitors.md +++ b/docs/_posts/2020-11-23-monitor_registry_keys_for_print_monitors.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-23 toc: true +toc_label: "" tags: - TTP - T1547.010 @@ -35,8 +36,8 @@ This search looks for registry activity associated with modifications to the reg #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1547.010](https://attack.mitre.org/techniques/T1547/010/) | Port Monitors | Persistence, Privilege Escalation | diff --git a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md index cd12a68e3e..61fda801af 100644 --- a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md +++ b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-23 toc: true +toc_label: "" tags: - TTP - T1546.011 @@ -36,8 +37,8 @@ This search detects the process execution and arguments required to silently cre #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1546.011](https://attack.mitre.org/techniques/T1546/011/) | Application Shimming | Privilege Escalation, Persistence | diff --git a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md index 0dec23acc2..d74d8c60ab 100644 --- a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md +++ b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-26 toc: true +toc_label: "" tags: - TTP - T1574.011 @@ -37,8 +38,8 @@ The search looks for reg.exe modifying registry keys that define Windows service #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1574.011](https://attack.mitre.org/techniques/T1574/011/) | Services Registry Permissions Weakness | Persistence, Privilege Escalation, Defense Evasion | diff --git a/docs/_posts/2020-11-26-registry_keys_for_creating_shim_databases.md b/docs/_posts/2020-11-26-registry_keys_for_creating_shim_databases.md index f7071b575e..58d24d8968 100644 --- a/docs/_posts/2020-11-26-registry_keys_for_creating_shim_databases.md +++ b/docs/_posts/2020-11-26-registry_keys_for_creating_shim_databases.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-26 toc: true +toc_label: "" tags: - TTP - T1546.011 @@ -35,8 +36,8 @@ This search looks for registry activity associated with application compatibilit #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1546.011](https://attack.mitre.org/techniques/T1546/011/) | Application Shimming | Privilege Escalation, Persistence | diff --git a/docs/_posts/2020-11-27-registry_keys_used_for_privilege_escalation.md b/docs/_posts/2020-11-27-registry_keys_used_for_privilege_escalation.md index a1a0542fec..f6cd226bba 100644 --- a/docs/_posts/2020-11-27-registry_keys_used_for_privilege_escalation.md +++ b/docs/_posts/2020-11-27-registry_keys_used_for_privilege_escalation.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-27 toc: true +toc_label: "" tags: - TTP - T1546.012 @@ -35,8 +36,8 @@ This search looks for modifications to registry keys that can be used to elevate #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1546.012](https://attack.mitre.org/techniques/T1546/012/) | Image File Execution Options Injection | Privilege Escalation, Persistence | diff --git a/docs/_posts/2020-11-30-remote_process_instantiation_via_wmi.md b/docs/_posts/2020-11-30-remote_process_instantiation_via_wmi.md index 58bf92d820..ab054ccd62 100644 --- a/docs/_posts/2020-11-30-remote_process_instantiation_via_wmi.md +++ b/docs/_posts/2020-11-30-remote_process_instantiation_via_wmi.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-30 toc: true +toc_label: "" tags: - TTP - T1047 @@ -35,8 +36,8 @@ This analytic identifies wmic.exe being launched with parameters to spawn a proc #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | diff --git a/docs/_posts/2020-11-30-rundll_loading_dll_by_ordinal.md b/docs/_posts/2020-11-30-rundll_loading_dll_by_ordinal.md index fd8528e3de..60eff6d597 100644 --- a/docs/_posts/2020-11-30-rundll_loading_dll_by_ordinal.md +++ b/docs/_posts/2020-11-30-rundll_loading_dll_by_ordinal.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-11-30 toc: true +toc_label: "" tags: - TTP - T1218.011 @@ -35,8 +36,8 @@ This search looks for executing scripts with rundll32. Adversaries may abuse run #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | diff --git a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md index 5a2980c9a4..4d627a2284 100644 --- a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md +++ b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-12-07 toc: true +toc_label: "" tags: - TTP - T1053.005 @@ -37,8 +38,8 @@ This search looks for flags passed to schtasks.exe on the command-line that indi #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation | diff --git a/docs/_posts/2020-12-08-shim_database_file_creation.md b/docs/_posts/2020-12-08-shim_database_file_creation.md index c46dbe9256..ee52a6cf26 100644 --- a/docs/_posts/2020-12-08-shim_database_file_creation.md +++ b/docs/_posts/2020-12-08-shim_database_file_creation.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-12-08 toc: true +toc_label: "" tags: - TTP - T1546.011 @@ -35,8 +36,8 @@ This search looks for shim database files being written to default directories. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1546.011](https://attack.mitre.org/techniques/T1546/011/) | Application Shimming | Privilege Escalation, Persistence | diff --git a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md index e7c51c5c65..b33105830f 100644 --- a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md +++ b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-12-08 toc: true +toc_label: "" tags: - TTP - T1204.002 @@ -35,8 +36,8 @@ This search looks for process names that consist only of a single letter. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1204.002](https://attack.mitre.org/techniques/T1204/002/) | Malicious File | Execution | diff --git a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md index ce88f701eb..e20621be76 100644 --- a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md +++ b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-12-08 toc: true +toc_label: "" tags: - TTP - T1036.003 @@ -37,8 +38,8 @@ During triage, review the parallel processes - what process moved the native Win #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | diff --git a/docs/_posts/2020-12-08-unusually_long_command_line.md b/docs/_posts/2020-12-08-unusually_long_command_line.md index bd4afe22b1..7f7f409156 100644 --- a/docs/_posts/2020-12-08-unusually_long_command_line.md +++ b/docs/_posts/2020-12-08-unusually_long_command_line.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-12-08 toc: true +toc_label: "" tags: - Anomaly - Splunk Enterprise diff --git a/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md b/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md index 7304218f22..e526e78208 100644 --- a/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md +++ b/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-12-08 toc: true +toc_label: "" tags: - TTP - T1546.003 @@ -40,8 +41,8 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1546.003](https://attack.mitre.org/techniques/T1546/003/) | Windows Management Instrumentation Event Subscription | Privilege Escalation, Persistence | diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md index 4ad7cc1b35..d66f459e63 100644 --- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md +++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-12-14 toc: true +toc_label: "" tags: - TTP - T1203 @@ -36,8 +37,8 @@ The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1203](https://attack.mitre.org/techniques/T1203/) | Exploitation for Client Execution | Execution | diff --git a/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md b/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md index b0247df6d7..8823e1be3e 100644 --- a/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md +++ b/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-12-15 toc: true +toc_label: "" tags: - TTP - T1114.002 @@ -35,8 +36,8 @@ This search detects the assignment of rights to accesss content from another mai #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1114.002](https://attack.mitre.org/techniques/T1114/002/) | Remote Email Collection | Collection | diff --git a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md index 25190235eb..85acdf5bc4 100644 --- a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md +++ b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-12-16 toc: true +toc_label: "" tags: - Anomaly - T1110.001 @@ -36,8 +37,8 @@ This search will detect more than 5 login failures in Office365 Azure Active Dir #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1110.001](https://attack.mitre.org/techniques/T1110/001/) | Password Guessing | Credential Access | diff --git a/docs/_posts/2020-12-16-o365_disable_mfa.md b/docs/_posts/2020-12-16-o365_disable_mfa.md index 555cd24810..2354b6f646 100644 --- a/docs/_posts/2020-12-16-o365_disable_mfa.md +++ b/docs/_posts/2020-12-16-o365_disable_mfa.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-12-16 toc: true +toc_label: "" tags: - TTP - T1556 @@ -37,8 +38,8 @@ This search detects when multi factor authentication has been disabled, what ent #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1556](https://attack.mitre.org/techniques/T1556/) | Modify Authentication Process | Credential Access, Defense Evasion, Persistence | diff --git a/docs/_posts/2020-12-16-o365_excessive_authentication_failures_alert.md b/docs/_posts/2020-12-16-o365_excessive_authentication_failures_alert.md index 8805826a3c..ec87d7a284 100644 --- a/docs/_posts/2020-12-16-o365_excessive_authentication_failures_alert.md +++ b/docs/_posts/2020-12-16-o365_excessive_authentication_failures_alert.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-12-16 toc: true +toc_label: "" tags: - Anomaly - T1110 @@ -35,8 +36,8 @@ This search detects when an excessive number of authentication failures occur th #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | diff --git a/docs/_posts/2020-12-16-o365_pst_export_alert.md b/docs/_posts/2020-12-16-o365_pst_export_alert.md index 42ab5d403c..7c12971fd6 100644 --- a/docs/_posts/2020-12-16-o365_pst_export_alert.md +++ b/docs/_posts/2020-12-16-o365_pst_export_alert.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-12-16 toc: true +toc_label: "" tags: - TTP - T1114 @@ -35,8 +36,8 @@ This search detects when a user has performed an Ediscovery search or exported a #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection | diff --git a/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md b/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md index c1d340426e..00b582f383 100644 --- a/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md +++ b/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-12-16 toc: true +toc_label: "" tags: - Anomaly - T1114.003 @@ -35,8 +36,8 @@ This search detects when an admin configured a forwarding rule for multiple mail #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1114.003](https://attack.mitre.org/techniques/T1114/003/) | Email Forwarding Rule | Collection | diff --git a/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md b/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md index af30b27476..c8f655f2ab 100644 --- a/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md +++ b/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2020-12-16 toc: true +toc_label: "" tags: - Anomaly - T1114.003 @@ -35,8 +36,8 @@ This search detects when multiple user configured a forwarding rule to the same #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1114.003](https://attack.mitre.org/techniques/T1114/003/) | Email Forwarding Rule | Collection | diff --git a/docs/_posts/2020-12-16-windows_adfind_exe.md b/docs/_posts/2020-12-16-windows_adfind_exe.md index 3247a4247a..969139b545 100644 --- a/docs/_posts/2020-12-16-windows_adfind_exe.md +++ b/docs/_posts/2020-12-16-windows_adfind_exe.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-12-16 toc: true +toc_label: "" tags: - TTP - T1018 @@ -37,8 +38,8 @@ This search looks for the execution of `adfind.exe` with command-line arguments #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | diff --git a/docs/_posts/2020-12-17-scheduled_task_deleted_or_created_via_cmd.md b/docs/_posts/2020-12-17-scheduled_task_deleted_or_created_via_cmd.md index dcbf014c6b..9a98f0209e 100644 --- a/docs/_posts/2020-12-17-scheduled_task_deleted_or_created_via_cmd.md +++ b/docs/_posts/2020-12-17-scheduled_task_deleted_or_created_via_cmd.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-12-17 toc: true +toc_label: "" tags: - TTP - T1053.005 @@ -37,8 +38,8 @@ This search looks for flags passed to schtasks.exe on the command-line that indi #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation | diff --git a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md index 02ec3b2970..781e600e70 100644 --- a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md +++ b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-12-21 toc: true +toc_label: "" tags: - TTP - T1490 @@ -35,8 +36,8 @@ This search looks for flags passed to bcdedit.exe modifications to the built-in #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | diff --git a/docs/_posts/2020-6-04-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2020-6-04-attempted_credential_dump_from_registry_via_reg_exe.md index 14f3aea511..f6dce104ae 100644 --- a/docs/_posts/2020-6-04-attempted_credential_dump_from_registry_via_reg_exe.md +++ b/docs/_posts/2020-6-04-attempted_credential_dump_from_registry_via_reg_exe.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-6-04 toc: true +toc_label: "" tags: - TTP - T1003 @@ -32,8 +33,8 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | diff --git a/docs/_posts/2020-7-13-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-7-13-detect_prohibited_applications_spawning_cmd_exe.md index eb18818e0a..7dc5d932ed 100644 --- a/docs/_posts/2020-7-13-detect_prohibited_applications_spawning_cmd_exe.md +++ b/docs/_posts/2020-7-13-detect_prohibited_applications_spawning_cmd_exe.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2020-7-13 toc: true +toc_label: "" tags: - TTP - T1059 @@ -32,8 +33,8 @@ This search looks for executions of cmd.exe spawned by a process that is often a #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | diff --git a/docs/_posts/2021-01-06-supernova_webshell.md b/docs/_posts/2021-01-06-supernova_webshell.md index 365871629b..9bce681c30 100644 --- a/docs/_posts/2021-01-06-supernova_webshell.md +++ b/docs/_posts/2021-01-06-supernova_webshell.md @@ -5,6 +5,7 @@ categories: - Web last_modified_at: 2021-01-06 toc: true +toc_label: "" tags: - TTP - T1505.003 @@ -37,8 +38,8 @@ This search aims to detect the Supernova webshell used in the SUNBURST attack. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1505.003](https://attack.mitre.org/techniques/T1505/003/) | Web Shell | Persistence | diff --git a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md index 3d32c0f64b..875b597a11 100644 --- a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md +++ b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-01-11 toc: true +toc_label: "" tags: - TTP - T1486 @@ -34,8 +35,8 @@ This search provides detection of KMS keys where action kms:Encrypt is accessibl #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact | diff --git a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md index ffc6917c4f..96258f7f29 100644 --- a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md +++ b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-01-11 toc: true +toc_label: "" tags: - Anomaly - T1486 @@ -34,8 +35,8 @@ This search provides detection of users with KMS keys performing encryption spec #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact | diff --git a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md index ea34766c15..6ddf3dd376 100644 --- a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md +++ b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-01-11 toc: true +toc_label: "" tags: - TTP - T1562.007 @@ -35,8 +36,8 @@ The search looks for AWS CloudTrail events to detect if any network ACLs were cr #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.007](https://attack.mitre.org/techniques/T1562/007/) | Disable or Modify Cloud Firewall | Defense Evasion | diff --git a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md index 714899f96b..8a27162491 100644 --- a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md +++ b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-01-12 toc: true +toc_label: "" tags: - Anomaly - T1562.007 @@ -35,8 +36,8 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.007](https://attack.mitre.org/techniques/T1562/007/) | Disable or Modify Cloud Firewall | Defense Evasion | diff --git a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md index 3d4647b489..11d8e38417 100644 --- a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md +++ b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-01-12 toc: true +toc_label: "" tags: - TTP - T1127 @@ -35,8 +36,8 @@ The following analytic identifies microsoft.workflow.compiler.exe usage. microso #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1127](https://attack.mitre.org/techniques/T1127/) | Trusted Developer Utilities Proxy Execution | Defense Evasion | diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_path.md b/docs/_posts/2021-01-12-suspicious_msbuild_path.md index 9ed1827ddb..87cdaba494 100644 --- a/docs/_posts/2021-01-12-suspicious_msbuild_path.md +++ b/docs/_posts/2021-01-12-suspicious_msbuild_path.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-01-12 toc: true +toc_label: "" tags: - TTP - T1127.001 @@ -38,8 +39,8 @@ The following analytic identifies msbuild.exe executing from a non-standard path #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1127.001](https://attack.mitre.org/techniques/T1127/001/) | MSBuild | Defense Evasion || [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_rename.md b/docs/_posts/2021-01-12-suspicious_msbuild_rename.md index 4780653f60..d5a941f14c 100644 --- a/docs/_posts/2021-01-12-suspicious_msbuild_rename.md +++ b/docs/_posts/2021-01-12-suspicious_msbuild_rename.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-01-12 toc: true +toc_label: "" tags: - TTP - T1127.001 @@ -38,8 +39,8 @@ The following analytic identifies renamed instances of msbuild.exe executing. Ms #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1127.001](https://attack.mitre.org/techniques/T1127/001/) | MSBuild | Defense Evasion || [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md index 146e9a0830..fb446a3d9d 100644 --- a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md +++ b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-01-12 toc: true +toc_label: "" tags: - TTP - T1127.001 @@ -35,8 +36,8 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1127.001](https://attack.mitre.org/techniques/T1127/001/) | MSBuild | Defense Evasion | diff --git a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md index 04e02e95e8..b564d621b6 100644 --- a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md +++ b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-01-12 toc: true +toc_label: "" tags: - TTP - T1218.005 @@ -35,8 +36,8 @@ The following analytic identifies child processes spawning from "mshta.exe& #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | diff --git a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md index 34a109606c..0ed3f29277 100644 --- a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md +++ b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2021-01-14 toc: true +toc_label: "" tags: - TTP - T1189 @@ -36,8 +37,8 @@ Malicious actors often abuse legitimate Dynamic DNS services to host malicious p #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1189](https://attack.mitre.org/techniques/T1189/) | Drive-by Compromise | Initial Access | diff --git a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md index e81ee97d2f..ed5582c236 100644 --- a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md +++ b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-01-19 toc: true +toc_label: "" tags: - TTP - T1059.001 @@ -36,8 +37,8 @@ This search looks for PowerShell processes launched with arguments that have cha #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | diff --git a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md index 1ab909490e..2830d99230 100644 --- a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md +++ b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-01-20 toc: true +toc_label: "" tags: - TTP - T1218.005 @@ -35,8 +36,8 @@ The following analytic identifies "rundll32.exe" execution with inline p #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | diff --git a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md index 3c5c41e23d..354669dcc1 100644 --- a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md +++ b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-01-20 toc: true +toc_label: "" tags: - TTP - T1218.005 @@ -35,8 +36,8 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | diff --git a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md index 5789744c5c..6c120d439e 100644 --- a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md +++ b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-01-22 toc: true +toc_label: "" tags: - TTP - T1490 @@ -35,8 +36,8 @@ This search looks for flags passed to wbadmin.exe (Windows Backup Administrator #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | diff --git a/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md b/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md index fca3683a54..167dfcdf1e 100644 --- a/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md +++ b/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-01-25 toc: true +toc_label: "" tags: - TTP - T1482 @@ -35,8 +36,8 @@ This search looks for the execution of `nltest.exe` with command-line arguments #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | diff --git a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md index 628229fa17..0befc7e4d5 100644 --- a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md +++ b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-01-26 toc: true +toc_label: "" tags: - Anomaly - T1078 @@ -37,8 +38,8 @@ This search provides specific SAML access from specific Service Provider, user a #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md index 9535618096..5619293978 100644 --- a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md +++ b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-01-26 toc: true +toc_label: "" tags: - TTP - T1078 @@ -37,8 +38,8 @@ This search provides detection of updates to SAML provider in AWS. Updates to SA #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md index d7ee0ed0ac..22c65bb9c7 100644 --- a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md +++ b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-01-26 toc: true +toc_label: "" tags: - TTP - Splunk Enterprise diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md index f5380646bf..1e3c41af88 100644 --- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md +++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-01-26 toc: true +toc_label: "" tags: - Anomaly - Splunk Security Analytics for AWS diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md index b7838575cd..38a870194f 100644 --- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md +++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-01-26 toc: true +toc_label: "" tags: - Anomaly - Splunk Enterprise diff --git a/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md b/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md index 48246041e9..f49e72aa89 100644 --- a/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md +++ b/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-01-26 toc: true +toc_label: "" tags: - TTP - T1136.003 @@ -35,8 +36,8 @@ This search detects the creation of a new Federation setting by alerting about a #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1136.003](https://attack.mitre.org/techniques/T1136/003/) | Cloud Account | Persistence | diff --git a/docs/_posts/2021-01-26-o365_added_service_principal.md b/docs/_posts/2021-01-26-o365_added_service_principal.md index 1c90ebcdfc..18de310435 100644 --- a/docs/_posts/2021-01-26-o365_added_service_principal.md +++ b/docs/_posts/2021-01-26-o365_added_service_principal.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-01-26 toc: true +toc_label: "" tags: - TTP - T1136.003 @@ -35,8 +36,8 @@ This search detects the creation of a new Federation setting by alerting about a #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1136.003](https://attack.mitre.org/techniques/T1136/003/) | Cloud Account | Persistence | diff --git a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md index c983d54f9b..edda2c8b31 100644 --- a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md +++ b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-01-26 toc: true +toc_label: "" tags: - Anomaly - T1556 @@ -37,8 +38,8 @@ This search detects accounts with high number of Single Sign ON (SSO) logon erro #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1556](https://attack.mitre.org/techniques/T1556/) | Modify Authentication Process | Credential Access, Defense Evasion, Persistence | diff --git a/docs/_posts/2021-01-26-o365_new_federated_domain_added.md b/docs/_posts/2021-01-26-o365_new_federated_domain_added.md index 21a858680f..5f4b48e76b 100644 --- a/docs/_posts/2021-01-26-o365_new_federated_domain_added.md +++ b/docs/_posts/2021-01-26-o365_new_federated_domain_added.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-01-26 toc: true +toc_label: "" tags: - TTP - T1136.003 @@ -35,8 +36,8 @@ This search detects the addition of a new Federated domain. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1136.003](https://attack.mitre.org/techniques/T1136/003/) | Cloud Account | Persistence | diff --git a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md index cc7faca6ad..77b321653c 100644 --- a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md +++ b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-01-27 toc: true +toc_label: "" tags: - TTP - T1068 @@ -36,8 +37,8 @@ This search detects the heap-based buffer overflow of sudoedit #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | diff --git a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md index 4865bbe3d9..03d23a7ee3 100644 --- a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md +++ b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-01-28 toc: true +toc_label: "" tags: - TTP - T1068 @@ -36,8 +37,8 @@ This search detects the heap-based buffer overflow of sudoedit #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | diff --git a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md index 9850eee6df..9ac328538b 100644 --- a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md +++ b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-01-28 toc: true +toc_label: "" tags: - TTP - T1218.010 @@ -36,8 +37,8 @@ Upon investigating, look for network connections to remote destinations (interna #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.010](https://attack.mitre.org/techniques/T1218/010/) | Regsvr32 | Defense Evasion | diff --git a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md index 935259ac7d..7f73989521 100644 --- a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md +++ b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-01-28 toc: true +toc_label: "" tags: - TTP - T1003.003 @@ -37,8 +38,8 @@ This technique uses "Install from Media" (IFM), which will extract a cop #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003.003](https://attack.mitre.org/techniques/T1003/003/) | NTDS | Credential Access | diff --git a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md index f9d84b0b48..b585c7f7c5 100644 --- a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md +++ b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-01-28 toc: true +toc_label: "" tags: - TTP - T1218.010 @@ -35,8 +36,8 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.010](https://attack.mitre.org/techniques/T1218/010/) | Regsvr32 | Defense Evasion | diff --git a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md index 3a148374aa..4c191ec47d 100644 --- a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md +++ b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-01-29 toc: true +toc_label: "" tags: - TTP - T1068 @@ -36,8 +37,8 @@ This search detects the heap-based buffer overflow of sudoedit #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md index 3689290ba6..ffcbe58e76 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-02-04 toc: true +toc_label: "" tags: - TTP - T1218.011 @@ -35,8 +36,8 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md index aadfc5ad04..5c5cda21a2 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-02-04 toc: true +toc_label: "" tags: - TTP - T1218.011 @@ -35,8 +36,8 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md index 5d1fe1ece0..50eb744557 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-02-04 toc: true +toc_label: "" tags: - TTP - T1218.011 @@ -35,8 +36,8 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | diff --git a/docs/_posts/2021-02-04-suspicious_rundll32_rename.md b/docs/_posts/2021-02-04-suspicious_rundll32_rename.md index 4025990820..8b9daf3fd8 100644 --- a/docs/_posts/2021-02-04-suspicious_rundll32_rename.md +++ b/docs/_posts/2021-02-04-suspicious_rundll32_rename.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-02-04 toc: true +toc_label: "" tags: - Hunting - T1218.011 @@ -38,8 +39,8 @@ The following analytic identifies renamed instances of rundll32.exe executing. r #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion || [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | diff --git a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md index 485b738cc1..9158d38fc4 100644 --- a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md +++ b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-02-04 toc: true +toc_label: "" tags: - TTP - T1218.011 @@ -35,8 +36,8 @@ The following analytic identifies rundll32.exe executing a DLL function name, St #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | diff --git a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md index 9717a85a60..1bd08b9949 100644 --- a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md +++ b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-02-09 toc: true +toc_label: "" tags: - TTP - T1218.011 @@ -35,8 +36,8 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | diff --git a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md index 2bb0a1ff45..fc9e5f1271 100644 --- a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md +++ b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-02-11 toc: true +toc_label: "" tags: - TTP - T1218.001 @@ -35,8 +36,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.001](https://attack.mitre.org/techniques/T1218/001/) | Compiled HTML File | Defense Evasion | diff --git a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md index 726c2dc43b..188f709d39 100644 --- a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md +++ b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-02-12 toc: true +toc_label: "" tags: - TTP - T1218.009 @@ -35,8 +36,8 @@ The following analytic identifies regasm.exe spawning a process. This particular #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | diff --git a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md index 979a155090..3a80c39e31 100644 --- a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md +++ b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-02-12 toc: true +toc_label: "" tags: - TTP - T1218.009 @@ -35,8 +36,8 @@ The following analytic identifies regsvcs.exe spawning a process. This particula #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | diff --git a/docs/_posts/2021-02-16-detect_regasm_with_network_connection.md b/docs/_posts/2021-02-16-detect_regasm_with_network_connection.md index 8f4524c6f7..1504162936 100644 --- a/docs/_posts/2021-02-16-detect_regasm_with_network_connection.md +++ b/docs/_posts/2021-02-16-detect_regasm_with_network_connection.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-02-16 toc: true +toc_label: "" tags: - TTP - T1218.009 @@ -34,8 +35,8 @@ The following analytic identifies regasm.exe with a network connection to a publ #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | diff --git a/docs/_posts/2021-02-16-detect_regsvcs_with_network_connection.md b/docs/_posts/2021-02-16-detect_regsvcs_with_network_connection.md index 355c2aa830..9e39e563ec 100644 --- a/docs/_posts/2021-02-16-detect_regsvcs_with_network_connection.md +++ b/docs/_posts/2021-02-16-detect_regsvcs_with_network_connection.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-02-16 toc: true +toc_label: "" tags: - TTP - T1218.009 @@ -34,8 +35,8 @@ The following analytic identifies Regsvcs.exe with a network connection to a pub #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | diff --git a/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md b/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md index fc6084d424..0260349ff1 100644 --- a/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md +++ b/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-02-22 toc: true +toc_label: "" tags: - TTP - T1078.004 @@ -38,8 +39,8 @@ This search looks for AWS CloudTrail events where a user created a policy versio #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md b/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md index 41709843cb..6d56db3285 100644 --- a/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md +++ b/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-02-22 toc: true +toc_label: "" tags: - TTP - T1055 @@ -36,8 +37,8 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | diff --git a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md index a7f6ab97e2..9e28b9140d 100644 --- a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md +++ b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-02-22 toc: true +toc_label: "" tags: - TTP - T1105 @@ -37,8 +38,8 @@ The following analytic identifies the use of a curl contacting suspicious remote #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control | diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md index 706142b592..95da496f07 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-02-22 toc: true +toc_label: "" tags: - TTP - T1543.001 @@ -45,8 +46,8 @@ Upon triage, capture the property list file being written to disk and review for #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1543.001](https://attack.mitre.org/techniques/T1543/001/) | Launch Agent | Persistence, Privilege Escalation | diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md index 446692f8d0..063270c2bf 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-02-22 toc: true +toc_label: "" tags: - TTP - T1543.001 @@ -44,8 +45,8 @@ Upon triage, capture the property list file being written to disk and review for #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1543.001](https://attack.mitre.org/techniques/T1543/001/) | Launch Agent | Persistence, Privilege Escalation | diff --git a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md index d8e5e8e501..75a207c8ea 100644 --- a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md +++ b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-02-22 toc: true +toc_label: "" tags: - TTP - T1074 @@ -37,8 +38,8 @@ The following analytic identifies the use of a SQLite3 querying the MacOS prefer #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1074](https://attack.mitre.org/techniques/T1074/) | Data Staged | Collection | diff --git a/docs/_posts/2021-03-01-any_powershell_downloadfile.md b/docs/_posts/2021-03-01-any_powershell_downloadfile.md index 76818d652b..6843874547 100644 --- a/docs/_posts/2021-03-01-any_powershell_downloadfile.md +++ b/docs/_posts/2021-03-01-any_powershell_downloadfile.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-01 toc: true +toc_label: "" tags: - TTP - T1059.001 @@ -35,8 +36,8 @@ The following analytic identifies the use of PowerShell downloading a file using #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | diff --git a/docs/_posts/2021-03-01-any_powershell_downloadstring.md b/docs/_posts/2021-03-01-any_powershell_downloadstring.md index 23a2298e58..f1f60c68ae 100644 --- a/docs/_posts/2021-03-01-any_powershell_downloadstring.md +++ b/docs/_posts/2021-03-01-any_powershell_downloadstring.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-01 toc: true +toc_label: "" tags: - TTP - T1059.001 @@ -35,8 +36,8 @@ The following analytic identifies the use of PowerShell downloading a file using #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | diff --git a/docs/_posts/2021-03-01-eventvwr_uac_bypass.md b/docs/_posts/2021-03-01-eventvwr_uac_bypass.md index cc8125dd11..72e94a3d17 100644 --- a/docs/_posts/2021-03-01-eventvwr_uac_bypass.md +++ b/docs/_posts/2021-03-01-eventvwr_uac_bypass.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-01 toc: true +toc_label: "" tags: - TTP - T1548.002 @@ -37,8 +38,8 @@ The following search identifies Eventvwr bypass by identifying the registry modi #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Privilege Escalation, Defense Evasion | diff --git a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md index 795c8f43af..e6d4e626c3 100644 --- a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md +++ b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-01 toc: true +toc_label: "" tags: - TTP - T1112 @@ -44,8 +45,8 @@ Upon triage, fodhelper.exe will have a child process and read access will occur #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | | [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Privilege Escalation, Defense Evasion | diff --git a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md index 7a48b44b1d..bc650975f9 100644 --- a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md +++ b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-01 toc: true +toc_label: "" tags: - TTP - T1059.003 @@ -36,8 +37,8 @@ This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution | diff --git a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md index 5cf8ed3034..44c449167f 100644 --- a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md +++ b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-01 toc: true +toc_label: "" tags: - Anomaly - T1053.005 @@ -38,8 +39,8 @@ The following detection identifies Scheduled Tasks registering (creating a new t #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation | diff --git a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md index 567d149be6..2430d5750c 100644 --- a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md +++ b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-03-02 toc: true +toc_label: "" tags: - TTP - T1078.004 @@ -38,8 +39,8 @@ This search looks for AWS CloudTrail events where a user has set a default polic #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md index 3688ecc326..3bca3a550f 100644 --- a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md +++ b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-02 toc: true +toc_label: "" tags: - TTP - T1190 @@ -35,8 +36,8 @@ This detection identifies Microsoft Exchange Server's Unified Messaging serv #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | diff --git a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md index 32a04b3783..ce1dafdd3e 100644 --- a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md +++ b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-02 toc: true +toc_label: "" tags: - TTP - T1562.001 @@ -35,8 +36,8 @@ The search looks for the Registry Key DisableAntiSpyware set to disable. This is #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | diff --git a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md index 434b792f90..85b83daff3 100644 --- a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md +++ b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-03 toc: true +toc_label: "" tags: - TTP - T1059.001 @@ -35,8 +36,8 @@ This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | diff --git a/docs/_posts/2021-03-03-w3wp_spawning_shell.md b/docs/_posts/2021-03-03-w3wp_spawning_shell.md index 9284d7f86d..1a387ac7f9 100644 --- a/docs/_posts/2021-03-03-w3wp_spawning_shell.md +++ b/docs/_posts/2021-03-03-w3wp_spawning_shell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-03 toc: true +toc_label: "" tags: - TTP - T1505.003 @@ -35,8 +36,8 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1505.003](https://attack.mitre.org/techniques/T1505/003/) | Web Shell | Persistence | diff --git a/docs/_posts/2021-03-12-create_service_in_suspicious_file_path.md b/docs/_posts/2021-03-12-create_service_in_suspicious_file_path.md index f410e85042..7623e82aa8 100644 --- a/docs/_posts/2021-03-12-create_service_in_suspicious_file_path.md +++ b/docs/_posts/2021-03-12-create_service_in_suspicious_file_path.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-12 toc: true +toc_label: "" tags: - TTP - T1569.002 @@ -35,8 +36,8 @@ This detection is to identify a creation of "user mode service" where th #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1569.002](https://attack.mitre.org/techniques/T1569/002/) | Service Execution | Execution | diff --git a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md index 096f4aac53..d9ec2b6ec1 100644 --- a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md +++ b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-12 toc: true +toc_label: "" tags: - Anomaly - T1486 @@ -35,8 +36,8 @@ The following analytics identifies a big number of instance of ransomware notes #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact | diff --git a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md index d48f7e504f..c789ad45c6 100644 --- a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md +++ b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-12 toc: true +toc_label: "" tags: - TTP - T1490 @@ -35,8 +36,8 @@ The following analytics identifies the resizing of shadowstorage by ransomware m #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | diff --git a/docs/_posts/2021-03-16-high_file_deletion_frequency.md b/docs/_posts/2021-03-16-high_file_deletion_frequency.md index 4dfbedcabf..3de66a2595 100644 --- a/docs/_posts/2021-03-16-high_file_deletion_frequency.md +++ b/docs/_posts/2021-03-16-high_file_deletion_frequency.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-16 toc: true +toc_label: "" tags: - Anomaly - T1485 @@ -35,8 +36,8 @@ This search looks for high frequency of file deletion relative to process name a #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1485](https://attack.mitre.org/techniques/T1485/) | Data Destruction | Impact | diff --git a/docs/_posts/2021-03-16-high_process_termination_frequency.md b/docs/_posts/2021-03-16-high_process_termination_frequency.md index b64581c76f..39cba53f39 100644 --- a/docs/_posts/2021-03-16-high_process_termination_frequency.md +++ b/docs/_posts/2021-03-16-high_process_termination_frequency.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-16 toc: true +toc_label: "" tags: - Anomaly - T1486 @@ -35,8 +36,8 @@ This analytics are designed to indentify a high frequency of process termination #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact | diff --git a/docs/_posts/2021-03-17-clop_common_exec_parameter.md b/docs/_posts/2021-03-17-clop_common_exec_parameter.md index 16f071e0d3..affda4e13f 100644 --- a/docs/_posts/2021-03-17-clop_common_exec_parameter.md +++ b/docs/_posts/2021-03-17-clop_common_exec_parameter.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-17 toc: true +toc_label: "" tags: - TTP - T1204 @@ -35,8 +36,8 @@ The following analytics are designed to identifies some CLOP ransomware variant #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | diff --git a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md index 68f7a52e77..48a99902c0 100644 --- a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md +++ b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-17 toc: true +toc_label: "" tags: - TTP - T1543 @@ -36,8 +37,8 @@ This detection is to identify the common service name created by the CLOP ransom #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | diff --git a/docs/_posts/2021-03-17-process_deleting_its_process_file_path.md b/docs/_posts/2021-03-17-process_deleting_its_process_file_path.md index 503c023ba6..e0cce34cb2 100644 --- a/docs/_posts/2021-03-17-process_deleting_its_process_file_path.md +++ b/docs/_posts/2021-03-17-process_deleting_its_process_file_path.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-17 toc: true +toc_label: "" tags: - TTP - T1070 @@ -35,8 +36,8 @@ This detection is to identify a suspicious process that tries to delete the proc #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | diff --git a/docs/_posts/2021-03-23-certutil_download_with_urlcache_and_split_arguments.md b/docs/_posts/2021-03-23-certutil_download_with_urlcache_and_split_arguments.md index 0d4f7aedd7..577c061223 100644 --- a/docs/_posts/2021-03-23-certutil_download_with_urlcache_and_split_arguments.md +++ b/docs/_posts/2021-03-23-certutil_download_with_urlcache_and_split_arguments.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-23 toc: true +toc_label: "" tags: - TTP - T1105 @@ -35,8 +36,8 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control | diff --git a/docs/_posts/2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md b/docs/_posts/2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md index 7e43f60b32..cf25dfc578 100644 --- a/docs/_posts/2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md +++ b/docs/_posts/2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-23 toc: true +toc_label: "" tags: - TTP - T1105 @@ -35,8 +36,8 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control | diff --git a/docs/_posts/2021-03-23-certutil_with_decode_argument.md b/docs/_posts/2021-03-23-certutil_with_decode_argument.md index 1d9909313e..5420434475 100644 --- a/docs/_posts/2021-03-23-certutil_with_decode_argument.md +++ b/docs/_posts/2021-03-23-certutil_with_decode_argument.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-23 toc: true +toc_label: "" tags: - TTP - T1140 @@ -35,8 +36,8 @@ CertUtil.exe may be used to `encode` and `decode` a file, including PE and scrip #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1140](https://attack.mitre.org/techniques/T1140/) | Deobfuscate/Decode Files or Information | Defense Evasion | diff --git a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md index c8d25d36b7..e187fe766b 100644 --- a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md +++ b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-29 toc: true +toc_label: "" tags: - TTP - T1197 @@ -36,8 +37,8 @@ Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1197](https://attack.mitre.org/techniques/T1197/) | BITS Jobs | Defense Evasion, Persistence | diff --git a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md index 612a1a5d81..c892d50767 100644 --- a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md +++ b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-03-31 toc: true +toc_label: "" tags: - Hunting - T1069.003 @@ -38,8 +39,8 @@ The following query uses IAM events to track the success of a group being delete #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1069.003](https://attack.mitre.org/techniques/T1069/003/) | Cloud Groups | Discovery || [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | diff --git a/docs/_posts/2021-03-31-disable_registry_tool.md b/docs/_posts/2021-03-31-disable_registry_tool.md index c30a7bbf6b..19dd5b8b86 100644 --- a/docs/_posts/2021-03-31-disable_registry_tool.md +++ b/docs/_posts/2021-03-31-disable_registry_tool.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-31 toc: true +toc_label: "" tags: - TTP - T1562.001 @@ -35,8 +36,8 @@ This search identifies modification of registry to disable the regedit or regist #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | diff --git a/docs/_posts/2021-03-31-disable_show_hidden_files.md b/docs/_posts/2021-03-31-disable_show_hidden_files.md index 7984583950..993e1c78c9 100644 --- a/docs/_posts/2021-03-31-disable_show_hidden_files.md +++ b/docs/_posts/2021-03-31-disable_show_hidden_files.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-31 toc: true +toc_label: "" tags: - TTP - T1564.001 @@ -38,8 +39,8 @@ The following analytic is to identify a modification in the Windows registry to #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1564.001](https://attack.mitre.org/techniques/T1564/001/) | Hidden Files and Directories | Defense Evasion || [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | diff --git a/docs/_posts/2021-03-31-disable_windows_behavior_monitoring.md b/docs/_posts/2021-03-31-disable_windows_behavior_monitoring.md index 70afcd8aa9..b9577f98bb 100644 --- a/docs/_posts/2021-03-31-disable_windows_behavior_monitoring.md +++ b/docs/_posts/2021-03-31-disable_windows_behavior_monitoring.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-31 toc: true +toc_label: "" tags: - TTP - T1562.001 @@ -35,8 +36,8 @@ This search is to identifies a modification in registry to disable the windows d #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | diff --git a/docs/_posts/2021-03-31-disable_windows_smartscreen_protection.md b/docs/_posts/2021-03-31-disable_windows_smartscreen_protection.md index c0ed53e6f0..535f7bcde3 100644 --- a/docs/_posts/2021-03-31-disable_windows_smartscreen_protection.md +++ b/docs/_posts/2021-03-31-disable_windows_smartscreen_protection.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-31 toc: true +toc_label: "" tags: - TTP - T1562.001 @@ -35,8 +36,8 @@ The following search identifies a modification of registry to disable the smarts #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | diff --git a/docs/_posts/2021-03-31-disabling_cmd_application.md b/docs/_posts/2021-03-31-disabling_cmd_application.md index 6e7d7d99be..279b07d087 100644 --- a/docs/_posts/2021-03-31-disabling_cmd_application.md +++ b/docs/_posts/2021-03-31-disabling_cmd_application.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-31 toc: true +toc_label: "" tags: - TTP - T1562.001 @@ -35,8 +36,8 @@ this search is to identify modification in registry to disable cmd prompt applic #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | diff --git a/docs/_posts/2021-03-31-disabling_controlpanel.md b/docs/_posts/2021-03-31-disabling_controlpanel.md index ba9a2ec1bd..583c5c7722 100644 --- a/docs/_posts/2021-03-31-disabling_controlpanel.md +++ b/docs/_posts/2021-03-31-disabling_controlpanel.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-31 toc: true +toc_label: "" tags: - TTP - T1562.001 @@ -35,8 +36,8 @@ this search is to identify registry modification to disable control panel window #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | diff --git a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md index 8cb36ae365..e5dc00ebf7 100644 --- a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md +++ b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-31 toc: true +toc_label: "" tags: - TTP - T1562.001 @@ -35,8 +36,8 @@ This search is to identifies suspicious firewall disabling using netsh applicati #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | diff --git a/docs/_posts/2021-03-31-disabling_folderoptions_windows_feature.md b/docs/_posts/2021-03-31-disabling_folderoptions_windows_feature.md index d0e466463f..cdf3ed43e2 100644 --- a/docs/_posts/2021-03-31-disabling_folderoptions_windows_feature.md +++ b/docs/_posts/2021-03-31-disabling_folderoptions_windows_feature.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-31 toc: true +toc_label: "" tags: - TTP - T1562.001 @@ -35,8 +36,8 @@ This search is to identify registry modification to disable folder options featu #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | diff --git a/docs/_posts/2021-03-31-disabling_norun_windows_app.md b/docs/_posts/2021-03-31-disabling_norun_windows_app.md index 1ff95a685f..161103c4d1 100644 --- a/docs/_posts/2021-03-31-disabling_norun_windows_app.md +++ b/docs/_posts/2021-03-31-disabling_norun_windows_app.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-31 toc: true +toc_label: "" tags: - TTP - T1562.001 @@ -35,8 +36,8 @@ This search is to identify modification of registry to disable run application i #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | diff --git a/docs/_posts/2021-03-31-disabling_systemrestore_in_registry.md b/docs/_posts/2021-03-31-disabling_systemrestore_in_registry.md index cf7b48e1b8..19424c0020 100644 --- a/docs/_posts/2021-03-31-disabling_systemrestore_in_registry.md +++ b/docs/_posts/2021-03-31-disabling_systemrestore_in_registry.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-31 toc: true +toc_label: "" tags: - TTP - T1562.001 @@ -35,8 +36,8 @@ The following search identifies the modification of registry related in disablin #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | diff --git a/docs/_posts/2021-03-31-disabling_task_manager.md b/docs/_posts/2021-03-31-disabling_task_manager.md index 27f40dfba7..71e9c0f0b8 100644 --- a/docs/_posts/2021-03-31-disabling_task_manager.md +++ b/docs/_posts/2021-03-31-disabling_task_manager.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-31 toc: true +toc_label: "" tags: - TTP - T1562.001 @@ -35,8 +36,8 @@ This search is to identifies modification of registry to disable the task manage #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | diff --git a/docs/_posts/2021-03-31-dsquery_domain_discovery.md b/docs/_posts/2021-03-31-dsquery_domain_discovery.md index fb9a5d8bb0..96fd9001ba 100644 --- a/docs/_posts/2021-03-31-dsquery_domain_discovery.md +++ b/docs/_posts/2021-03-31-dsquery_domain_discovery.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-03-31 toc: true +toc_label: "" tags: - TTP - T1482 @@ -40,8 +41,8 @@ In addition to trust discovery, review parallel processes for additional behavio #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | diff --git a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md index ee8f7e1fb7..93126b3560 100644 --- a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md +++ b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-04-01 toc: true +toc_label: "" tags: - TTP - T1580 @@ -38,8 +39,8 @@ The following detection identifies any malformed policy document exceptions with #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1580](https://attack.mitre.org/techniques/T1580/) | Cloud Infrastructure Discovery | Discovery | | [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | diff --git a/docs/_posts/2021-04-01-aws_iam_delete_policy.md b/docs/_posts/2021-04-01-aws_iam_delete_policy.md index 0a73320969..00b415c7c7 100644 --- a/docs/_posts/2021-04-01-aws_iam_delete_policy.md +++ b/docs/_posts/2021-04-01-aws_iam_delete_policy.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-04-01 toc: true +toc_label: "" tags: - Hunting - T1098 @@ -35,8 +36,8 @@ The following detection identifes when a policy is deleted on AWS. This does not #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | diff --git a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md index 188a1c415e..6f9ea2cc15 100644 --- a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md +++ b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-04-01 toc: true +toc_label: "" tags: - Anomaly - T1098 @@ -35,8 +36,8 @@ This detection identifies failure attempts to delete groups. We want to identify #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | diff --git a/docs/_posts/2021-04-05-aws_iam_accessdenied_discovery_events.md b/docs/_posts/2021-04-05-aws_iam_accessdenied_discovery_events.md index b6ea59f935..0091e36a55 100644 --- a/docs/_posts/2021-04-05-aws_iam_accessdenied_discovery_events.md +++ b/docs/_posts/2021-04-05-aws_iam_accessdenied_discovery_events.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-04-05 toc: true +toc_label: "" tags: - Anomaly - T1580 @@ -35,8 +36,8 @@ The following detection identifies excessive AccessDenied events within an hour #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1580](https://attack.mitre.org/techniques/T1580/) | Cloud Infrastructure Discovery | Discovery | diff --git a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md index 5022a82cef..cc9b0afbbc 100644 --- a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md +++ b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-07 toc: true +toc_label: "" tags: - TTP - T1569.002 @@ -35,8 +36,8 @@ This detection is to identify the abuse the Windows SC.exe to execute malicious #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1569.002](https://attack.mitre.org/techniques/T1569/002/) | Service Execution | Execution | diff --git a/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md b/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md index 3ae5a22369..ffc4333087 100644 --- a/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md +++ b/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-08 toc: true +toc_label: "" tags: - Anomaly - T1110.003 @@ -38,8 +39,8 @@ The analytics returned fields allow analysts to investigate the event further by #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1110.003](https://attack.mitre.org/techniques/T1110/003/) | Password Spraying | Credential Access | diff --git a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md index a957f36821..9798a5c278 100644 --- a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md +++ b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-08 toc: true +toc_label: "" tags: - TTP - T1053.005 @@ -40,8 +41,8 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it v #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation | diff --git a/docs/_posts/2021-04-12-excel_spawning_powershell.md b/docs/_posts/2021-04-12-excel_spawning_powershell.md index e4684c9d24..401bc26f49 100644 --- a/docs/_posts/2021-04-12-excel_spawning_powershell.md +++ b/docs/_posts/2021-04-12-excel_spawning_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-12 toc: true +toc_label: "" tags: - TTP - T1003.002 @@ -35,8 +36,8 @@ The following detection identifies Microsoft Excel spawning PowerShell. Typicall #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003.002](https://attack.mitre.org/techniques/T1003/002/) | Security Account Manager | Credential Access | diff --git a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md index df5aecde6c..923da4c316 100644 --- a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md +++ b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-12 toc: true +toc_label: "" tags: - TTP - T1003.002 @@ -35,8 +36,8 @@ The following detection identifies Microsoft Excel spawning Windows Script Host #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003.002](https://attack.mitre.org/techniques/T1003/002/) | Security Account Manager | Credential Access | diff --git a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md index b3ce385bd3..cd0319302d 100644 --- a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md +++ b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-12 toc: true +toc_label: "" tags: - TTP - T1053.005 @@ -40,8 +41,8 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or via Task #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation | diff --git a/docs/_posts/2021-04-12-winword_spawning_powershell.md b/docs/_posts/2021-04-12-winword_spawning_powershell.md index 71a280abeb..b45d735e08 100644 --- a/docs/_posts/2021-04-12-winword_spawning_powershell.md +++ b/docs/_posts/2021-04-12-winword_spawning_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-12 toc: true +toc_label: "" tags: - TTP - T1566.001 @@ -35,8 +36,8 @@ The following detection identifies Microsoft Word spawning PowerShell. Typically #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md index 506a4d61bf..f5d3885b63 100644 --- a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md +++ b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-12 toc: true +toc_label: "" tags: - TTP - T1566.001 @@ -35,8 +36,8 @@ The following detection identifies Microsoft Winword.exe spawning Windows Script #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md index 717b2c3b81..02b2df3bdd 100644 --- a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md +++ b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-04-13 toc: true +toc_label: "" tags: - TTP - T1526 @@ -35,8 +36,8 @@ This search looks for AWS CloudTrail events and analyse the amount of eventNames #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery | diff --git a/docs/_posts/2021-04-13-multiple_users_attempting_to_authenticate_using_explicit_credentials.md b/docs/_posts/2021-04-13-multiple_users_attempting_to_authenticate_using_explicit_credentials.md index cf01d2c128..684868a64b 100644 --- a/docs/_posts/2021-04-13-multiple_users_attempting_to_authenticate_using_explicit_credentials.md +++ b/docs/_posts/2021-04-13-multiple_users_attempting_to_authenticate_using_explicit_credentials.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-13 toc: true +toc_label: "" tags: - Anomaly - T1110.003 @@ -38,8 +39,8 @@ The analytics returned fields allow analysts to investigate the event further by #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1110.003](https://attack.mitre.org/techniques/T1110/003/) | Password Spraying | Credential Access | diff --git a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md index 901461ad7a..200bda345c 100644 --- a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md +++ b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-13 toc: true +toc_label: "" tags: - Anomaly - T1110.003 @@ -38,8 +39,8 @@ The analytics returned fields allow analysts to investigate the event further by #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1110.003](https://attack.mitre.org/techniques/T1110/003/) | Password Spraying | Credential Access | diff --git a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md index 762a68150e..46854a8454 100644 --- a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md +++ b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-13 toc: true +toc_label: "" tags: - Anomaly - T1110.003 @@ -38,8 +39,8 @@ The analytics returned fields allow analysts to investigate the event further by #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1110.003](https://attack.mitre.org/techniques/T1110/003/) | Password Spraying | Credential Access | diff --git a/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md b/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md index cea9aa641e..9be61a4d7f 100644 --- a/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md +++ b/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-13 toc: true +toc_label: "" tags: - Anomaly - T1110.003 @@ -38,8 +39,8 @@ The analytics returned fields allow analysts to investigate the event further by #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1110.003](https://attack.mitre.org/techniques/T1110/003/) | Password Spraying | Credential Access | diff --git a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md index 98e925e564..94bbf4b715 100644 --- a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md +++ b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-13 toc: true +toc_label: "" tags: - TTP - T1566.001 @@ -35,8 +36,8 @@ this detection was designed to identifies suspicious spawned process of known MS #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2021-04-14-multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.md b/docs/_posts/2021-04-14-multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.md index 0e7aa52b1f..cd3287c4a5 100644 --- a/docs/_posts/2021-04-14-multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.md +++ b/docs/_posts/2021-04-14-multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-14 toc: true +toc_label: "" tags: - Anomaly - T1110.003 @@ -38,8 +39,8 @@ The analytics returned fields allow analysts to investigate the event further by #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1110.003](https://attack.mitre.org/techniques/T1110/003/) | Password Spraying | Credential Access | diff --git a/docs/_posts/2021-04-14-multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.md b/docs/_posts/2021-04-14-multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.md index cd6a5e929a..1d828ef654 100644 --- a/docs/_posts/2021-04-14-multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.md +++ b/docs/_posts/2021-04-14-multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-14 toc: true +toc_label: "" tags: - Anomaly - T1110.003 @@ -38,8 +39,8 @@ The analytics returned fields allow analysts to investigate the event further by #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1110.003](https://attack.mitre.org/techniques/T1110/003/) | Password Spraying | Credential Access | diff --git a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md index 5052d9a775..74aab63408 100644 --- a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md +++ b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-14 toc: true +toc_label: "" tags: - TTP - T1566.001 @@ -35,8 +36,8 @@ this search detects a potential malicious office document that create schedule t #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2021-04-14-office_document_executing_macro_code.md b/docs/_posts/2021-04-14-office_document_executing_macro_code.md index aeead88234..26d20db2b5 100644 --- a/docs/_posts/2021-04-14-office_document_executing_macro_code.md +++ b/docs/_posts/2021-04-14-office_document_executing_macro_code.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-14 toc: true +toc_label: "" tags: - TTP - T1566.001 @@ -35,8 +36,8 @@ this detection was designed to identifies suspicious office documents that using #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md index ac6d0c37bd..a0bb39dddd 100644 --- a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md +++ b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-15 toc: true +toc_label: "" tags: - TTP - T1048 @@ -35,8 +36,8 @@ this search is to detect potential DNS exfiltration using nslookup application. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | diff --git a/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md b/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md index c1b0e18be1..71d368ae11 100644 --- a/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md +++ b/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-15 toc: true +toc_label: "" tags: - Anomaly - T1110.003 @@ -38,8 +39,8 @@ The analytics returned fields allow analysts to investigate the event further by #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1110.003](https://attack.mitre.org/techniques/T1110/003/) | Password Spraying | Credential Access | diff --git a/docs/_posts/2021-04-19-dllhost_with_no_command_line_arguments_with_network.md b/docs/_posts/2021-04-19-dllhost_with_no_command_line_arguments_with_network.md index 11a3b9365b..ee7d2caea4 100644 --- a/docs/_posts/2021-04-19-dllhost_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2021-04-19-dllhost_with_no_command_line_arguments_with_network.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-19 toc: true +toc_label: "" tags: - TTP - T1055 @@ -36,8 +37,8 @@ The following analytic identifies DLLHost.exe with no command line arguments wit #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | diff --git a/docs/_posts/2021-04-19-gpupdate_with_no_command_line_arguments_with_network.md b/docs/_posts/2021-04-19-gpupdate_with_no_command_line_arguments_with_network.md index cb65193ef8..514819b7dc 100644 --- a/docs/_posts/2021-04-19-gpupdate_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2021-04-19-gpupdate_with_no_command_line_arguments_with_network.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-19 toc: true +toc_label: "" tags: - TTP - T1055 @@ -36,8 +37,8 @@ The following analytic identifies gpupdate.exe with no command line arguments an #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | diff --git a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md index 3ee8d33177..490045ebeb 100644 --- a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md +++ b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-19 toc: true +toc_label: "" tags: - TTP - T1055 @@ -36,8 +37,8 @@ this search is designed to detect suspicious powershell process that tries to in #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | diff --git a/docs/_posts/2021-04-19-rundll32_with_no_command_line_arguments_with_network.md b/docs/_posts/2021-04-19-rundll32_with_no_command_line_arguments_with_network.md index 2ffdb1e83c..2eed4bba73 100644 --- a/docs/_posts/2021-04-19-rundll32_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2021-04-19-rundll32_with_no_command_line_arguments_with_network.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-19 toc: true +toc_label: "" tags: - TTP - T1218.011 @@ -35,8 +36,8 @@ The following analytic identifies rundll32.exe with no command line arguments an #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | diff --git a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md index 4bee77f57d..47ceabe2f4 100644 --- a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md +++ b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-19 toc: true +toc_label: "" tags: - TTP - T1053 @@ -37,8 +38,8 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | diff --git a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md index 326fa2036d..b126ce045a 100644 --- a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md +++ b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-19 toc: true +toc_label: "" tags: - TTP - T1053 @@ -37,8 +38,8 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | diff --git a/docs/_posts/2021-04-19-searchprotocolhost_with_no_command_line_with_network.md b/docs/_posts/2021-04-19-searchprotocolhost_with_no_command_line_with_network.md index cc211770aa..19353d360c 100644 --- a/docs/_posts/2021-04-19-searchprotocolhost_with_no_command_line_with_network.md +++ b/docs/_posts/2021-04-19-searchprotocolhost_with_no_command_line_with_network.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-19 toc: true +toc_label: "" tags: - TTP - T1055 @@ -36,8 +37,8 @@ The following analytic identifies searchprotocolhost.exe with no command line ar #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | diff --git a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md index 845d8f19de..f211d7243f 100644 --- a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md +++ b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-19 toc: true +toc_label: "" tags: - TTP - T1590.005 @@ -35,8 +36,8 @@ this search is designed to detect suspicious wermgr.exe process that tries to co #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1590.005](https://attack.mitre.org/techniques/T1590/005/) | IP Addresses | Reconnaissance | diff --git a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md index 5d8e4fa53c..0065fce052 100644 --- a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md +++ b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-19 toc: true +toc_label: "" tags: - TTP - T1027 @@ -35,8 +36,8 @@ this search is designed to detect potential malicious wermgr.exe process that dr #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1027](https://attack.mitre.org/techniques/T1027/) | Obfuscated Files or Information | Defense Evasion | diff --git a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md index ba1c490f13..138d3587b9 100644 --- a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md +++ b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-19 toc: true +toc_label: "" tags: - TTP - T1059 @@ -35,8 +36,8 @@ This search is designed to detect suspicious cmd and powershell process spawned #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | diff --git a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md index 51d009c4e8..f48d380bcf 100644 --- a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md +++ b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-21 toc: true +toc_label: "" tags: - Anomaly - T1048 @@ -35,8 +36,8 @@ This search is to detect potential DNS exfiltration using nslookup application. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | diff --git a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md index 0b572fcbde..e65ff32d92 100644 --- a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md +++ b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2021-04-21 toc: true +toc_label: "" tags: - TTP - T1048.003 @@ -35,8 +36,8 @@ This search is designed to detect high frequency of archive files data exfiltrat #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration | diff --git a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md index 5f3dac5f87..41d14ec462 100644 --- a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md +++ b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-22 toc: true +toc_label: "" tags: - Anomaly - T1560.001 @@ -35,8 +36,8 @@ The following detection identifies a 7z.exe spawned from `Rundll32.exe` or `Dllh #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1560.001](https://attack.mitre.org/techniques/T1560/001/) | Archive via Utility | Collection | diff --git a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md index bbc769cb99..a5f0631389 100644 --- a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md +++ b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-22 toc: true +toc_label: "" tags: - TTP - T1566.001 @@ -35,8 +36,8 @@ The following detection identifies the latest behavior utilized by IcedID malwar #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md index 26daf2a6b7..45ff6fdefe 100644 --- a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md +++ b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2021-04-22 toc: true +toc_label: "" tags: - TTP - T1048.003 @@ -35,8 +36,8 @@ This search is to detect potential plain HTTP POST method data exfiltration. Thi #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration | diff --git a/docs/_posts/2021-04-22-winword_spawning_cmd.md b/docs/_posts/2021-04-22-winword_spawning_cmd.md index 9db5d061ac..968056a86a 100644 --- a/docs/_posts/2021-04-22-winword_spawning_cmd.md +++ b/docs/_posts/2021-04-22-winword_spawning_cmd.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-22 toc: true +toc_label: "" tags: - TTP - T1566.001 @@ -35,8 +36,8 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2021-04-23-write_executable_in_smb_share.md b/docs/_posts/2021-04-23-write_executable_in_smb_share.md index 5a59836528..a8d1ab763e 100644 --- a/docs/_posts/2021-04-23-write_executable_in_smb_share.md +++ b/docs/_posts/2021-04-23-write_executable_in_smb_share.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-23 toc: true +toc_label: "" tags: - TTP - T1021.002 @@ -35,8 +36,8 @@ This search is to detect suspicious dropping or creating an executable file in k #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement | diff --git a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md index f5bd818496..69074c1d73 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md +++ b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-26 toc: true +toc_label: "" tags: - TTP - T1566.001 @@ -35,8 +36,8 @@ The following detection identifies the latest behavior utilized by different mal #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2021-04-26-office_product_spawning_certutil.md b/docs/_posts/2021-04-26-office_product_spawning_certutil.md index d7b57e82b8..1a60e2cf43 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_certutil.md +++ b/docs/_posts/2021-04-26-office_product_spawning_certutil.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-26 toc: true +toc_label: "" tags: - TTP - T1566.001 @@ -35,8 +36,8 @@ The following detection identifies the latest behavior utilized by different mal #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2021-04-26-office_product_spawning_mshta.md b/docs/_posts/2021-04-26-office_product_spawning_mshta.md index 13dcf912f0..67b19c28c6 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_mshta.md +++ b/docs/_posts/2021-04-26-office_product_spawning_mshta.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-26 toc: true +toc_label: "" tags: - TTP - T1566.001 @@ -35,8 +36,8 @@ The following detection identifies the latest behavior utilized by different mal #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2021-04-26-trickbot_named_pipe.md b/docs/_posts/2021-04-26-trickbot_named_pipe.md index 76d33d1923..418d081bd8 100644 --- a/docs/_posts/2021-04-26-trickbot_named_pipe.md +++ b/docs/_posts/2021-04-26-trickbot_named_pipe.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-26 toc: true +toc_label: "" tags: - TTP - T1055 @@ -36,8 +37,8 @@ this search is to detect potential trickbot infection through the create/connect #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | diff --git a/docs/_posts/2021-04-29-icacls_deny_command.md b/docs/_posts/2021-04-29-icacls_deny_command.md index 1b7bcd902b..cafdc5a88a 100644 --- a/docs/_posts/2021-04-29-icacls_deny_command.md +++ b/docs/_posts/2021-04-29-icacls_deny_command.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-29 toc: true +toc_label: "" tags: - TTP - T1222 @@ -35,8 +36,8 @@ This analytic identifies a potential adversary that changes the security permiss #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | diff --git a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md index 84e8164993..370e2e4c65 100644 --- a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md +++ b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-29 toc: true +toc_label: "" tags: - TTP - T1543.003 @@ -36,8 +37,8 @@ This analytic will detect suspicious driver loaded paths. This technique is comm #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation | diff --git a/docs/_posts/2021-04-29-xmrig_driver_loaded.md b/docs/_posts/2021-04-29-xmrig_driver_loaded.md index df9f10f86b..8f8aba2d7e 100644 --- a/docs/_posts/2021-04-29-xmrig_driver_loaded.md +++ b/docs/_posts/2021-04-29-xmrig_driver_loaded.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-04-29 toc: true +toc_label: "" tags: - TTP - T1543.003 @@ -36,8 +37,8 @@ This analytic identifies XMRIG coinminer driver installation on the system. The #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation | diff --git a/docs/_posts/2021-05-04-deleting_of_net_users.md b/docs/_posts/2021-05-04-deleting_of_net_users.md index 1ea74869b9..44ba46a293 100644 --- a/docs/_posts/2021-05-04-deleting_of_net_users.md +++ b/docs/_posts/2021-05-04-deleting_of_net_users.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-04 toc: true +toc_label: "" tags: - TTP - T1531 @@ -35,8 +36,8 @@ This analytic will detect a suspicious net.exe/net1.exe command-line to delete a #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1531](https://attack.mitre.org/techniques/T1531/) | Account Access Removal | Impact | diff --git a/docs/_posts/2021-05-04-disabling_net_user_account.md b/docs/_posts/2021-05-04-disabling_net_user_account.md index 78f9ef939f..324ee81d5b 100644 --- a/docs/_posts/2021-05-04-disabling_net_user_account.md +++ b/docs/_posts/2021-05-04-disabling_net_user_account.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-04 toc: true +toc_label: "" tags: - TTP - T1531 @@ -35,8 +36,8 @@ This analytic will identify a suspicious command-line that disables a user accou #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1531](https://attack.mitre.org/techniques/T1531/) | Account Access Removal | Impact | diff --git a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md index eb62908913..729a1a1408 100644 --- a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md +++ b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-04 toc: true +toc_label: "" tags: - Anomaly - T1489 @@ -35,8 +36,8 @@ This analytic will identify suspicious series of command-line to disable several #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact | diff --git a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md index 789283fcb9..d592302c47 100644 --- a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md +++ b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-04 toc: true +toc_label: "" tags: - Anomaly - T1489 @@ -35,8 +36,8 @@ This analytic identifies suspicious series of attempt to kill multiple services #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact | diff --git a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md index 81a1b298a6..d16d279de9 100644 --- a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md +++ b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-04 toc: true +toc_label: "" tags: - Anomaly - T1562.001 @@ -35,8 +36,8 @@ This analytic identifies excessive usage of `taskkill.exe` application. This app #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | diff --git a/docs/_posts/2021-05-04-icacls_grant_command.md b/docs/_posts/2021-05-04-icacls_grant_command.md index 9916492b76..84c4362db7 100644 --- a/docs/_posts/2021-05-04-icacls_grant_command.md +++ b/docs/_posts/2021-05-04-icacls_grant_command.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-04 toc: true +toc_label: "" tags: - TTP - T1222 @@ -35,8 +36,8 @@ This analytic identifies potential adversaries that modify the security permissi #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | diff --git a/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md b/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md index 0f38c46a53..f609fe82e7 100644 --- a/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md +++ b/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-04 toc: true +toc_label: "" tags: - TTP - T1222 @@ -35,8 +36,8 @@ This analytic identifies suspicious modification of ACL permission to a files or #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | diff --git a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md index db67678c5d..4a4858cf4c 100644 --- a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md +++ b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-04 toc: true +toc_label: "" tags: - TTP - T1562.001 @@ -35,8 +36,8 @@ The following analytic identifies the use of `wmic.exe` using `delete` to remove #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | diff --git a/docs/_posts/2021-05-05-disable_windows_app_hotkeys.md b/docs/_posts/2021-05-05-disable_windows_app_hotkeys.md index 1e799cc0e3..758a867438 100644 --- a/docs/_posts/2021-05-05-disable_windows_app_hotkeys.md +++ b/docs/_posts/2021-05-05-disable_windows_app_hotkeys.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-05 toc: true +toc_label: "" tags: - TTP - T1562.001 @@ -35,8 +36,8 @@ This analytic detects a suspicious registry modification to disable Windows hotk #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | diff --git a/docs/_posts/2021-05-05-hide_user_account_from_sign-in_screen.md b/docs/_posts/2021-05-05-hide_user_account_from_sign-in_screen.md index a48d4c8538..53e01b313e 100644 --- a/docs/_posts/2021-05-05-hide_user_account_from_sign-in_screen.md +++ b/docs/_posts/2021-05-05-hide_user_account_from_sign-in_screen.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-05 toc: true +toc_label: "" tags: - TTP - T1562.001 @@ -35,8 +36,8 @@ This analytic identifies a suspicious registry modification to hide a user accou #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | diff --git a/docs/_posts/2021-05-05-suspicious_process_file_path.md b/docs/_posts/2021-05-05-suspicious_process_file_path.md index 2a998f5075..a5e3dd0032 100644 --- a/docs/_posts/2021-05-05-suspicious_process_file_path.md +++ b/docs/_posts/2021-05-05-suspicious_process_file_path.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-05 toc: true +toc_label: "" tags: - TTP - T1543 @@ -36,8 +37,8 @@ The following analytic will detect a suspicious process running in a file path w #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | diff --git a/docs/_posts/2021-05-06-download_files_using_telegram.md b/docs/_posts/2021-05-06-download_files_using_telegram.md index 4878206562..70bb6f402a 100644 --- a/docs/_posts/2021-05-06-download_files_using_telegram.md +++ b/docs/_posts/2021-05-06-download_files_using_telegram.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-06 toc: true +toc_label: "" tags: - TTP - T1105 @@ -35,8 +36,8 @@ The following analytic will identify a suspicious download by the Telegram appli #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control | diff --git a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md index c55e455c63..ddea0d84e0 100644 --- a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md +++ b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-06 toc: true +toc_label: "" tags: - TTP - T1087 @@ -35,8 +36,8 @@ This analytic will detect a suspicious Telegram process enumerating all network #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | diff --git a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md index 09dad18953..262967e5ae 100644 --- a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md +++ b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-06 toc: true +toc_label: "" tags: - Anomaly - T1531 @@ -35,8 +36,8 @@ This analytic identifies excessive usage of `net.exe` or `net1.exe` within a buc #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1531](https://attack.mitre.org/techniques/T1531/) | Account Access Removal | Impact | diff --git a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md index 82fb7a331a..edc44fc5f7 100644 --- a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md +++ b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-06 toc: true +toc_label: "" tags: - TTP - T1036 @@ -35,8 +36,8 @@ This analytic will identify suspicious executable or scripts (known file extensi #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion | diff --git a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md index c0b2ba8257..d09fae476a 100644 --- a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md +++ b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-07 toc: true +toc_label: "" tags: - Anomaly - T1222 @@ -35,8 +36,8 @@ The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` o #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | diff --git a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md index e7eaff8df3..db9843312e 100644 --- a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md +++ b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-07 toc: true +toc_label: "" tags: - TTP - T1053 @@ -37,8 +38,8 @@ This analytic identifies an on demand run of a Windows Schedule Task through she #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | diff --git a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md index ac86f5d55d..eab8792fac 100644 --- a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md +++ b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-12 toc: true +toc_label: "" tags: - TTP - T1490 @@ -35,8 +36,8 @@ This following analytic detects PowerShell command to delete shadow copy using t #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | diff --git a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md index 0c0d963018..83173242bb 100644 --- a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md +++ b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-13 toc: true +toc_label: "" tags: - TTP - T1218.003 @@ -35,8 +36,8 @@ This analytic detects a potential process using COM Object like CMLUA or CMSTPLU #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.003](https://attack.mitre.org/techniques/T1218/003/) | CMSTP | Defense Evasion | diff --git a/docs/_posts/2021-05-13-detect_rclone_command-line_usage.md b/docs/_posts/2021-05-13-detect_rclone_command-line_usage.md index 83205d2542..d45e6bbc1f 100644 --- a/docs/_posts/2021-05-13-detect_rclone_command-line_usage.md +++ b/docs/_posts/2021-05-13-detect_rclone_command-line_usage.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-13 toc: true +toc_label: "" tags: - TTP - T1020 @@ -35,8 +36,8 @@ This analytic identifies commonly used command-line arguments used by `rclone.ex #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1020](https://attack.mitre.org/techniques/T1020/) | Automated Exfiltration | Exfiltration | diff --git a/docs/_posts/2021-05-13-slui_runas_elevated.md b/docs/_posts/2021-05-13-slui_runas_elevated.md index b942786196..6e07e3fff0 100644 --- a/docs/_posts/2021-05-13-slui_runas_elevated.md +++ b/docs/_posts/2021-05-13-slui_runas_elevated.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-13 toc: true +toc_label: "" tags: - TTP - T1548.002 @@ -36,8 +37,8 @@ The following analytic identifies the Microsoft Software Licensing User Interfac #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Privilege Escalation, Defense Evasion | diff --git a/docs/_posts/2021-05-13-slui_spawning_a_process.md b/docs/_posts/2021-05-13-slui_spawning_a_process.md index 4ed4abd8b8..32f40f520a 100644 --- a/docs/_posts/2021-05-13-slui_spawning_a_process.md +++ b/docs/_posts/2021-05-13-slui_spawning_a_process.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-13 toc: true +toc_label: "" tags: - TTP - T1548.002 @@ -36,8 +37,8 @@ The following analytic identifies the Microsoft Software Licensing User Interfac #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Privilege Escalation, Defense Evasion | diff --git a/docs/_posts/2021-05-18-services_escalate_exe.md b/docs/_posts/2021-05-18-services_escalate_exe.md index 64ae86cb5f..343ef38b2f 100644 --- a/docs/_posts/2021-05-18-services_escalate_exe.md +++ b/docs/_posts/2021-05-18-services_escalate_exe.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-18 toc: true +toc_label: "" tags: - TTP - T1548 @@ -37,8 +38,8 @@ The following analytic identifies the use of `svc-exe` with Cobalt Strike. The b #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | diff --git a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md index bc7187018a..05e82effe3 100644 --- a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md +++ b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-19 toc: true +toc_label: "" tags: - TTP - T1021.001 @@ -35,8 +36,8 @@ The following analytic identifies suspicious PowerShell command to allow inbound #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement | diff --git a/docs/_posts/2021-05-19-enable_rdp_in_other_port_number.md b/docs/_posts/2021-05-19-enable_rdp_in_other_port_number.md index 83139a3861..e5ec09c66e 100644 --- a/docs/_posts/2021-05-19-enable_rdp_in_other_port_number.md +++ b/docs/_posts/2021-05-19-enable_rdp_in_other_port_number.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-19 toc: true +toc_label: "" tags: - TTP - T1021 @@ -35,8 +36,8 @@ This search is to detect a modification to registry to enable rdp to a machine w #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | diff --git a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md index 106e6ef2ca..0c92bd2ccc 100644 --- a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md +++ b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-19 toc: true +toc_label: "" tags: - TTP - T1114.001 @@ -35,8 +36,8 @@ This search is to detect known mailsniper.ps1 functions executed in a machine. T #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1114.001](https://attack.mitre.org/techniques/T1114/001/) | Local Email Collection | Collection | diff --git a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md index 362fadabad..c2cc2049d7 100644 --- a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md +++ b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-20 toc: true +toc_label: "" tags: - TTP - T1059.003 @@ -40,8 +41,8 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution || [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation | diff --git a/docs/_posts/2021-05-20-rare_parent-child_process_relationship.md b/docs/_posts/2021-05-20-rare_parent-child_process_relationship.md index 37237fa0b3..7432073b6f 100644 --- a/docs/_posts/2021-05-20-rare_parent-child_process_relationship.md +++ b/docs/_posts/2021-05-20-rare_parent-child_process_relationship.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-20 toc: true +toc_label: "" tags: - Anomaly - T1203 @@ -44,8 +45,8 @@ An attacker may use LOLBAS tools spawned from vulnerable applications not typica #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1203](https://attack.mitre.org/techniques/T1203/) | Exploitation for Client Execution | Execution | | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | diff --git a/docs/_posts/2021-05-21-winrm_spawning_a_process.md b/docs/_posts/2021-05-21-winrm_spawning_a_process.md index 0301b5be0f..1a7636e3dc 100644 --- a/docs/_posts/2021-05-21-winrm_spawning_a_process.md +++ b/docs/_posts/2021-05-21-winrm_spawning_a_process.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-21 toc: true +toc_label: "" tags: - TTP - T1190 @@ -39,8 +40,8 @@ The following analytic identifies suspicious processes spawning from WinRM (wsmp #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | diff --git a/docs/_posts/2021-05-26-allow_inbound_traffic_by_firewall_rule_registry.md b/docs/_posts/2021-05-26-allow_inbound_traffic_by_firewall_rule_registry.md index 84632eaeb8..9882460fb6 100644 --- a/docs/_posts/2021-05-26-allow_inbound_traffic_by_firewall_rule_registry.md +++ b/docs/_posts/2021-05-26-allow_inbound_traffic_by_firewall_rule_registry.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-26 toc: true +toc_label: "" tags: - TTP - T1021.001 @@ -35,8 +36,8 @@ This analytic detects a potential suspicious modification of firewall rule regis #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement | diff --git a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md index fbe1f1deb2..f6b9a63393 100644 --- a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md +++ b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-26 toc: true +toc_label: "" tags: - TTP - T1003.003 @@ -35,8 +36,8 @@ This analytic detects a potential usage of secretsdump.py tool for dumping crede #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003.003](https://attack.mitre.org/techniques/T1003/003/) | NTDS | Credential Access | diff --git a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md index cfeb57fdb4..2a507d4662 100644 --- a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md +++ b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-27 toc: true +toc_label: "" tags: - TTP - T1087.002 @@ -47,8 +48,8 @@ SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. Shar #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery || [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery || [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery || [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | diff --git a/docs/_posts/2021-05-27-detect_sharphound_usage.md b/docs/_posts/2021-05-27-detect_sharphound_usage.md index 880cf9ab3c..cb96bc6bc5 100644 --- a/docs/_posts/2021-05-27-detect_sharphound_usage.md +++ b/docs/_posts/2021-05-27-detect_sharphound_usage.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-05-27 toc: true +toc_label: "" tags: - TTP - T1087.002 @@ -47,8 +48,8 @@ The following analytic identifies SharpHound binary usage by using the original #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery || [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery || [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery || [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | diff --git a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md index 820e97eb4f..a806327270 100644 --- a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md +++ b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-01 toc: true +toc_label: "" tags: - TTP - T1087.002 @@ -47,8 +48,8 @@ The following analytic identifies the common command-line argument used by Azure #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery || [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery || [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery || [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | diff --git a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md index 8c672158c5..c565783178 100644 --- a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md +++ b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-01 toc: true +toc_label: "" tags: - TTP - T1087.002 @@ -47,8 +48,8 @@ The following analytic is similar to SharpHound file modifications, but this ins #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery || [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery || [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery || [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | diff --git a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md index 8f7aa78ed4..d71a32531e 100644 --- a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md +++ b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-01 toc: true +toc_label: "" tags: - TTP - T1087.002 @@ -47,8 +48,8 @@ The following analytic identifies common command-line arguments used by SharpHou #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery || [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery || [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery || [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | diff --git a/docs/_posts/2021-06-02-conti_common_exec_parameter.md b/docs/_posts/2021-06-02-conti_common_exec_parameter.md index 742c610ec4..9410a1daf6 100644 --- a/docs/_posts/2021-06-02-conti_common_exec_parameter.md +++ b/docs/_posts/2021-06-02-conti_common_exec_parameter.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-02 toc: true +toc_label: "" tags: - TTP - T1204 @@ -35,8 +36,8 @@ This search detects the suspicious commandline argument of revil ransomware to e #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | diff --git a/docs/_posts/2021-06-02-modification_of_wallpaper.md b/docs/_posts/2021-06-02-modification_of_wallpaper.md index 231cc3888b..fb1d4cf5fe 100644 --- a/docs/_posts/2021-06-02-modification_of_wallpaper.md +++ b/docs/_posts/2021-06-02-modification_of_wallpaper.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-02 toc: true +toc_label: "" tags: - TTP - T1491 @@ -35,8 +36,8 @@ This analytic identifies suspicious modification of registry to deface or change #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1491](https://attack.mitre.org/techniques/T1491/) | Defacement | Impact | diff --git a/docs/_posts/2021-06-02-revil_common_exec_parameter.md b/docs/_posts/2021-06-02-revil_common_exec_parameter.md index d365efb879..5964cd20c0 100644 --- a/docs/_posts/2021-06-02-revil_common_exec_parameter.md +++ b/docs/_posts/2021-06-02-revil_common_exec_parameter.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-02 toc: true +toc_label: "" tags: - TTP - T1204 @@ -35,8 +36,8 @@ This analytic identifies suspicious commandline parameter that are commonly used #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | diff --git a/docs/_posts/2021-06-02-revil_registry_entry.md b/docs/_posts/2021-06-02-revil_registry_entry.md index b23ada32c8..3204c084e2 100644 --- a/docs/_posts/2021-06-02-revil_registry_entry.md +++ b/docs/_posts/2021-06-02-revil_registry_entry.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-02 toc: true +toc_label: "" tags: - TTP - T1112 @@ -35,8 +36,8 @@ This analytic identifies suspicious modification in registry entry to keep some #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | diff --git a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md index 6854d3aac4..b707c2a634 100644 --- a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md +++ b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-02 toc: true +toc_label: "" tags: - TTP - T1218.003 @@ -35,8 +36,8 @@ this search is designed to detect potential malicious process loading COM object #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.003](https://attack.mitre.org/techniques/T1218/003/) | CMSTP | Defense Evasion | diff --git a/docs/_posts/2021-06-03-excessive_number_of_distinct_processes_created_in_windows_temp_folder.md b/docs/_posts/2021-06-03-excessive_number_of_distinct_processes_created_in_windows_temp_folder.md index f7659f6523..5e8133b9fa 100644 --- a/docs/_posts/2021-06-03-excessive_number_of_distinct_processes_created_in_windows_temp_folder.md +++ b/docs/_posts/2021-06-03-excessive_number_of_distinct_processes_created_in_windows_temp_folder.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-03 toc: true +toc_label: "" tags: - Anomaly - T1059 @@ -35,8 +36,8 @@ This analytic will identify suspicious series of process executions. We have ob #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | @@ -54,7 +55,7 @@ This analytic will identify suspicious series of process executions. We have ob ``` #### Associated Analytic Story -* [meterpreter](/stories/meterpreter) +* [Meterpreter](/stories/meterpreter) #### How To Implement diff --git a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md index e0ef3f509b..cdf2e6224f 100644 --- a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md +++ b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-04 toc: true +toc_label: "" tags: - TTP - T1490 @@ -35,8 +36,8 @@ This search detects a suspicioous termination of known services killed by ransom #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | diff --git a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md index bccc48534c..3996735be5 100644 --- a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md +++ b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-07 toc: true +toc_label: "" tags: - Anomaly - T1033 @@ -35,8 +36,8 @@ This detection targets behaviors observed in post exploit kits like Meterpreter #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | diff --git a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md index 67ca2b1d47..1a7f6abe4b 100644 --- a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md +++ b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-08 toc: true +toc_label: "" tags: - TTP - T1055 @@ -41,8 +42,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | diff --git a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md index d9a06f4f03..ff048dfbf9 100644 --- a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md +++ b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-08 toc: true +toc_label: "" tags: - TTP - T1027 @@ -41,8 +42,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1027](https://attack.mitre.org/techniques/T1027/) | Obfuscated Files or Information | Defense Evasion | | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | diff --git a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md index 7cde6511b1..2b314a5758 100644 --- a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md +++ b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-09 toc: true +toc_label: "" tags: - TTP - T1059.001 @@ -36,8 +37,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | diff --git a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md index cabeb5fbbb..3ce464651e 100644 --- a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md +++ b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-09 toc: true +toc_label: "" tags: - TTP - T1003 @@ -36,8 +37,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | diff --git a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md index e47cba8a59..b904fc1f1b 100644 --- a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md +++ b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-09 toc: true +toc_label: "" tags: - TTP - T1562 @@ -36,8 +37,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | diff --git a/docs/_posts/2021-06-10-allow_operation_with_consent_admin.md b/docs/_posts/2021-06-10-allow_operation_with_consent_admin.md index 081c1c45ba..3d7c8a7cf7 100644 --- a/docs/_posts/2021-06-10-allow_operation_with_consent_admin.md +++ b/docs/_posts/2021-06-10-allow_operation_with_consent_admin.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-10 toc: true +toc_label: "" tags: - TTP - T1548 @@ -36,8 +37,8 @@ This analytic identifies a potential privilege escalation attempt to perform mal #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Privilege Escalation, Defense Evasion | diff --git a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md index 4613521603..147e40dd41 100644 --- a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md +++ b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-10 toc: true +toc_label: "" tags: - TTP - T1070.004 @@ -35,8 +36,8 @@ this search is to detect execution of `cipher.exe` to clear the unallocated sect #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1070.004](https://attack.mitre.org/techniques/T1070/004/) | File Deletion | Defense Evasion | diff --git a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md index 641cf1bb3e..729771c1ce 100644 --- a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md +++ b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-10 toc: true +toc_label: "" tags: - TTP - T1070.001 @@ -35,8 +36,8 @@ This search is to detect execution of wevtutil.exe to disable logs. This techniq #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1070.001](https://attack.mitre.org/techniques/T1070/001/) | Clear Windows Event Logs | Defense Evasion | diff --git a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md index eef8e52b11..a38ce2aa67 100644 --- a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md +++ b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-10 toc: true +toc_label: "" tags: - TTP - T1222 @@ -35,8 +36,8 @@ This search is to detect a modification of file or directory permission using ta #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | diff --git a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md index 3c9d7471d6..90f6e77b1c 100644 --- a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md +++ b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-10 toc: true +toc_label: "" tags: - TTP - T1027.005 @@ -34,8 +35,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1027.005](https://attack.mitre.org/techniques/T1027/005/) | Indicator Removal from Tools | Defense Evasion | diff --git a/docs/_posts/2021-06-10-powershell_domain_enumeration.md b/docs/_posts/2021-06-10-powershell_domain_enumeration.md index 812dee780c..6b21279b79 100644 --- a/docs/_posts/2021-06-10-powershell_domain_enumeration.md +++ b/docs/_posts/2021-06-10-powershell_domain_enumeration.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-10 toc: true +toc_label: "" tags: - TTP - T1059.001 @@ -36,8 +37,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | diff --git a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_system_reflection_assembly.md b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_system_reflection_assembly.md index d6aac3ce1c..2bf2385c4e 100644 --- a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_system_reflection_assembly.md +++ b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_system_reflection_assembly.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-10 toc: true +toc_label: "" tags: - TTP - T1059.001 @@ -36,8 +37,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | diff --git a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md index 0fe8122b2f..3f60968b29 100644 --- a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md +++ b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-10 toc: true +toc_label: "" tags: - TTP - T1059.001 @@ -34,8 +35,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | diff --git a/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md b/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md index 6cd12c493e..af96312c02 100644 --- a/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md +++ b/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-10 toc: true +toc_label: "" tags: - TTP - T1140 @@ -34,8 +35,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1140](https://attack.mitre.org/techniques/T1140/) | Deobfuscate/Decode Files or Information | Defense Evasion | diff --git a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md index f478ed00c8..1bf5da0253 100644 --- a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md +++ b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-10 toc: true +toc_label: "" tags: - TTP - T1490 @@ -35,8 +36,8 @@ This search is to detect a suspicious bcdedit.exe execution to ignore all failur #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | diff --git a/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md b/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md index 4273d64351..fe898139d5 100644 --- a/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md +++ b/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-10 toc: true +toc_label: "" tags: - TTP - T1592 @@ -34,8 +35,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance | diff --git a/docs/_posts/2021-06-10-recon_using_wmi_class.md b/docs/_posts/2021-06-10-recon_using_wmi_class.md index 70c55a2139..4564c8822e 100644 --- a/docs/_posts/2021-06-10-recon_using_wmi_class.md +++ b/docs/_posts/2021-06-10-recon_using_wmi_class.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-10 toc: true +toc_label: "" tags: - TTP - T1592 @@ -34,8 +35,8 @@ The following analytic identifies suspicious PowerShell via EventCode 4104, wher #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance | diff --git a/docs/_posts/2021-06-10-start_up_during_safe_mode_boot.md b/docs/_posts/2021-06-10-start_up_during_safe_mode_boot.md index 8360b8232b..b860d78977 100644 --- a/docs/_posts/2021-06-10-start_up_during_safe_mode_boot.md +++ b/docs/_posts/2021-06-10-start_up_during_safe_mode_boot.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-10 toc: true +toc_label: "" tags: - TTP - T1547.001 @@ -36,8 +37,8 @@ This search is to detect a modification or registry add to the safeboot registry #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1547.001](https://attack.mitre.org/techniques/T1547/001/) | Registry Run Keys / Startup Folder | Persistence, Privilege Escalation | diff --git a/docs/_posts/2021-06-14-deny_permission_using_cacls_utility.md b/docs/_posts/2021-06-14-deny_permission_using_cacls_utility.md index 35cbfe453b..3d76468fb7 100644 --- a/docs/_posts/2021-06-14-deny_permission_using_cacls_utility.md +++ b/docs/_posts/2021-06-14-deny_permission_using_cacls_utility.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-14 toc: true +toc_label: "" tags: - TTP - T1222 @@ -33,8 +34,8 @@ This analytic identifies a potential adversary that changes the security permiss #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | diff --git a/docs/_posts/2021-06-14-grant_permission_using_cacls_utility.md b/docs/_posts/2021-06-14-grant_permission_using_cacls_utility.md index 2ea2dcca04..3142758ab9 100644 --- a/docs/_posts/2021-06-14-grant_permission_using_cacls_utility.md +++ b/docs/_posts/2021-06-14-grant_permission_using_cacls_utility.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-14 toc: true +toc_label: "" tags: - TTP - T1222 @@ -33,8 +34,8 @@ This analytic identifies potential adversaries that modify the security permissi #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | diff --git a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md index f2fc94fbac..7b46ac5bc3 100644 --- a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md +++ b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-14 toc: true +toc_label: "" tags: - TTP - T1592 @@ -34,8 +35,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance | diff --git a/docs/_posts/2021-06-15-modify_acls_permission_of_files_or_folders.md b/docs/_posts/2021-06-15-modify_acls_permission_of_files_or_folders.md index e1e506c4a6..4e5c3819d5 100644 --- a/docs/_posts/2021-06-15-modify_acls_permission_of_files_or_folders.md +++ b/docs/_posts/2021-06-15-modify_acls_permission_of_files_or_folders.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-15 toc: true +toc_label: "" tags: - Anomaly - T1222 @@ -33,8 +34,8 @@ This analytic identifies suspicious modification of ACL permission to a files or #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | diff --git a/docs/_posts/2021-06-15-wevtutil_usage_to_clear_logs.md b/docs/_posts/2021-06-15-wevtutil_usage_to_clear_logs.md index 485a465cc8..efed70ec90 100644 --- a/docs/_posts/2021-06-15-wevtutil_usage_to_clear_logs.md +++ b/docs/_posts/2021-06-15-wevtutil_usage_to_clear_logs.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-15 toc: true +toc_label: "" tags: - TTP - T1070.001 @@ -33,8 +34,8 @@ The wevtutil.exe application is the windows event log utility. This searches for #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1070.001](https://attack.mitre.org/techniques/T1070/001/) | Clear Windows Event Logs | Defense Evasion | diff --git a/docs/_posts/2021-06-15-wevtutil_usage_to_disable_logs.md b/docs/_posts/2021-06-15-wevtutil_usage_to_disable_logs.md index 9cf085f185..c34d070119 100644 --- a/docs/_posts/2021-06-15-wevtutil_usage_to_disable_logs.md +++ b/docs/_posts/2021-06-15-wevtutil_usage_to_disable_logs.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-15 toc: true +toc_label: "" tags: - TTP - T1070.001 @@ -33,8 +34,8 @@ This search is to detect execution of wevtutil.exe to disable logs. This techniq #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1070.001](https://attack.mitre.org/techniques/T1070/001/) | Clear Windows Event Logs | Defense Evasion | diff --git a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md index cf780be2aa..ced804b45a 100644 --- a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md +++ b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-16 toc: true +toc_label: "" tags: - TTP - T1546.003 @@ -40,8 +41,8 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1546.003](https://attack.mitre.org/techniques/T1546/003/) | Windows Management Instrumentation Event Subscription | Privilege Escalation, Persistence | diff --git a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md index d5c7827fda..48fed249bd 100644 --- a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md +++ b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-17 toc: true +toc_label: "" tags: - TTP - T1070.001 @@ -34,8 +35,8 @@ The following analytic utilizes Windows Event ID 1100 to identify when Windows e #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1070.001](https://attack.mitre.org/techniques/T1070/001/) | Clear Windows Event Logs | Defense Evasion | diff --git a/docs/_posts/2021-06-18-attempt_to_delete_services.md b/docs/_posts/2021-06-18-attempt_to_delete_services.md index 0bf6cde8c7..14d3009a4f 100644 --- a/docs/_posts/2021-06-18-attempt_to_delete_services.md +++ b/docs/_posts/2021-06-18-attempt_to_delete_services.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-18 toc: true +toc_label: "" tags: - TTP - T1489 @@ -33,8 +34,8 @@ This analytic identifies suspicious series of attempt to kill multiple services #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact | diff --git a/docs/_posts/2021-06-18-attempt_to_disable_services.md b/docs/_posts/2021-06-18-attempt_to_disable_services.md index 7a1f2b0b3a..e57f6cef1c 100644 --- a/docs/_posts/2021-06-18-attempt_to_disable_services.md +++ b/docs/_posts/2021-06-18-attempt_to_disable_services.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-18 toc: true +toc_label: "" tags: - TTP - T1489 @@ -33,8 +34,8 @@ This analytic will identify suspicious series of command-line to disable several #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact | diff --git a/docs/_posts/2021-06-21-attacker_tools_on_endpoint.md b/docs/_posts/2021-06-21-attacker_tools_on_endpoint.md index 8dde65e862..4da564bc85 100644 --- a/docs/_posts/2021-06-21-attacker_tools_on_endpoint.md +++ b/docs/_posts/2021-06-21-attacker_tools_on_endpoint.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-21 toc: true +toc_label: "" tags: - TTP - T1036.005 @@ -43,8 +44,8 @@ This search looks for execution of commonly used attacker tools on an endpoint. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1036.005](https://attack.mitre.org/techniques/T1036/005/) | Match Legitimate Name or Location | Defense Evasion || [T1595](https://attack.mitre.org/techniques/T1595/) | Active Scanning | Reconnaissance | | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | diff --git a/docs/_posts/2021-06-21-delete_a_net_user.md b/docs/_posts/2021-06-21-delete_a_net_user.md index b67a03d4c8..cd6c6daa4f 100644 --- a/docs/_posts/2021-06-21-delete_a_net_user.md +++ b/docs/_posts/2021-06-21-delete_a_net_user.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-21 toc: true +toc_label: "" tags: - Anomaly - T1489 @@ -33,8 +34,8 @@ This analytic will detect a suspicious net.exe/net1.exe command-line to delete a #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact | diff --git a/docs/_posts/2021-06-21-disable_net_user_account.md b/docs/_posts/2021-06-21-disable_net_user_account.md index eb477beef0..a8e9af3997 100644 --- a/docs/_posts/2021-06-21-disable_net_user_account.md +++ b/docs/_posts/2021-06-21-disable_net_user_account.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-21 toc: true +toc_label: "" tags: - TTP - T1489 @@ -33,8 +34,8 @@ This analytic will identify a suspicious command-line that disables a user accou #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact | diff --git a/docs/_posts/2021-06-21-resize_shadowstorage_volume.md b/docs/_posts/2021-06-21-resize_shadowstorage_volume.md index 0e29c4c276..3b7bf7e057 100644 --- a/docs/_posts/2021-06-21-resize_shadowstorage_volume.md +++ b/docs/_posts/2021-06-21-resize_shadowstorage_volume.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-21 toc: true +toc_label: "" tags: - TTP - T1489 @@ -33,8 +34,8 @@ The following analytics identifies the resizing of shadowstorage by ransomware m #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact | diff --git a/docs/_posts/2021-06-22-disable_amsi_through_registry.md b/docs/_posts/2021-06-22-disable_amsi_through_registry.md index a41959992a..cab9839222 100644 --- a/docs/_posts/2021-06-22-disable_amsi_through_registry.md +++ b/docs/_posts/2021-06-22-disable_amsi_through_registry.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-22 toc: true +toc_label: "" tags: - TTP - T1562.001 @@ -35,8 +36,8 @@ this search is to identify modification in registry to disable AMSI windows feat #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | diff --git a/docs/_posts/2021-06-22-disable_etw_through_registry.md b/docs/_posts/2021-06-22-disable_etw_through_registry.md index b2da0dfb93..d043123630 100644 --- a/docs/_posts/2021-06-22-disable_etw_through_registry.md +++ b/docs/_posts/2021-06-22-disable_etw_through_registry.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-22 toc: true +toc_label: "" tags: - TTP - T1562.001 @@ -35,8 +36,8 @@ this search is to identify modification in registry to disable ETW windows featu #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | diff --git a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md index 2a2ce1c46c..9fe88b96c8 100644 --- a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md +++ b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-22 toc: true +toc_label: "" tags: - TTP - T1059.005 @@ -35,8 +36,8 @@ This analytic will identify suspicious process of cscript.exe where it tries to #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059.005](https://attack.mitre.org/techniques/T1059/005/) | Visual Basic | Execution | diff --git a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md index 96b80d1dab..b28e216ca0 100644 --- a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md +++ b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-22 toc: true +toc_label: "" tags: - TTP - T1027.005 @@ -35,8 +36,8 @@ This search is to detect a suspicious enabling of smb1protocol through "powe #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1027.005](https://attack.mitre.org/techniques/T1027/005/) | Indicator Removal from Tools | Defense Evasion | diff --git a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md index d56901d3f6..c717105ff9 100644 --- a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md +++ b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-22 toc: true +toc_label: "" tags: - TTP - T1070.004 @@ -35,8 +36,8 @@ This search is to detect a suspicious commandline designed to delete files or di #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1070.004](https://attack.mitre.org/techniques/T1070/004/) | File Deletion | Defense Evasion | diff --git a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md index a48176298a..b8eaebe8d7 100644 --- a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-23 toc: true +toc_label: "" tags: - TTP - T1562.007 @@ -35,8 +36,8 @@ This search is to detect a suspicious modification of firewall to allow file and #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.007](https://attack.mitre.org/techniques/T1562/007/) | Disable or Modify Cloud Firewall | Defense Evasion | diff --git a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md index f819742b02..05262c1467 100644 --- a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-23 toc: true +toc_label: "" tags: - TTP - T1562.007 @@ -35,8 +36,8 @@ This search is to detect a suspicious modification to the firewall to allow netw #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.007](https://attack.mitre.org/techniques/T1562/007/) | Disable or Modify Cloud Firewall | Defense Evasion | diff --git a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md index 4181d05da6..6a948faeb5 100644 --- a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md +++ b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-24 toc: true +toc_label: "" tags: - Anomaly - T1569.002 @@ -35,8 +36,8 @@ This search is to detect a suspicious excessive usage of sc.exe in a host machin #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1569.002](https://attack.mitre.org/techniques/T1569/002/) | Service Execution | Execution | diff --git a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md index 1a9ef85bcb..84ee6013be 100644 --- a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md +++ b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-06-25 toc: true +toc_label: "" tags: - Anomaly - T1562.001 @@ -35,8 +36,8 @@ This detection targets behaviors observed when threat actors have used sc.exe to #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | diff --git a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md index ea3b467cc3..dc6044b3cb 100644 --- a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md +++ b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-01 toc: true +toc_label: "" tags: - TTP - T1547.012 @@ -38,8 +39,8 @@ During triage, isolate the endpoint and review for source of exploitation. Captu #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1547.012](https://attack.mitre.org/techniques/T1547/012/) | Print Processors | Persistence, Privilege Escalation | diff --git a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md index 0a8d989397..71a000e8e4 100644 --- a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md +++ b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-01 toc: true +toc_label: "" tags: - TTP - T1547.012 @@ -39,8 +40,8 @@ During triage, isolate the endpoint and review for source of exploitation. Captu #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1547.012](https://attack.mitre.org/techniques/T1547/012/) | Print Processors | Persistence, Privilege Escalation | diff --git a/docs/_posts/2021-07-01-sdclt_uac_bypass.md b/docs/_posts/2021-07-01-sdclt_uac_bypass.md index 5d50ec1550..07ed7791a4 100644 --- a/docs/_posts/2021-07-01-sdclt_uac_bypass.md +++ b/docs/_posts/2021-07-01-sdclt_uac_bypass.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-01 toc: true +toc_label: "" tags: - TTP - T1548.002 @@ -36,8 +37,8 @@ This search is to detect a suspicious sdclt.exe registry modification. This tech #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Privilege Escalation, Defense Evasion | diff --git a/docs/_posts/2021-07-01-silentcleanup_uac_bypass.md b/docs/_posts/2021-07-01-silentcleanup_uac_bypass.md index 0f40ce03ce..d3b7d2e1e7 100644 --- a/docs/_posts/2021-07-01-silentcleanup_uac_bypass.md +++ b/docs/_posts/2021-07-01-silentcleanup_uac_bypass.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-01 toc: true +toc_label: "" tags: - TTP - T1548.002 @@ -36,8 +37,8 @@ This search is to detect a suspicious modification of registry that may related #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Privilege Escalation, Defense Evasion | diff --git a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md index 3f25e17c4d..da293dfadc 100644 --- a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md +++ b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-01 toc: true +toc_label: "" tags: - TTP - T1547.012 @@ -36,8 +37,8 @@ The following analytic identifies a suspicious child process, `rundll32.exe`, wi #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1547.012](https://attack.mitre.org/techniques/T1547/012/) | Print Processors | Persistence, Privilege Escalation | diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md index ac5d8f5871..0d14ec3e0c 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-01 toc: true +toc_label: "" tags: - TTP - T1547.012 @@ -36,8 +37,8 @@ This search is to detect suspicious loading of dll in specific path relative to #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1547.012](https://attack.mitre.org/techniques/T1547/012/) | Print Processors | Persistence, Privilege Escalation | diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md index bdac723c1b..1f56f9828a 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-01 toc: true +toc_label: "" tags: - TTP - T1068 @@ -35,8 +36,8 @@ This analytic identifies a suspicious behavior related to PrintNightmare, or CVE #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md index 1fd6c6b180..f5fa863333 100644 --- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md +++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-01 toc: true +toc_label: "" tags: - TTP - T1547.012 @@ -36,8 +37,8 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1547.012](https://attack.mitre.org/techniques/T1547/012/) | Print Processors | Persistence, Privilege Escalation | diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md index 7768e63564..2101932568 100644 --- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md +++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-01 toc: true +toc_label: "" tags: - TTP - T1547.012 @@ -36,8 +37,8 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1547.012](https://attack.mitre.org/techniques/T1547/012/) | Print Processors | Persistence, Privilege Escalation | diff --git a/docs/_posts/2021-07-01-wsreset_uac_bypass.md b/docs/_posts/2021-07-01-wsreset_uac_bypass.md index 27231db964..f8695fb529 100644 --- a/docs/_posts/2021-07-01-wsreset_uac_bypass.md +++ b/docs/_posts/2021-07-01-wsreset_uac_bypass.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-01 toc: true +toc_label: "" tags: - TTP - T1548.002 @@ -36,8 +37,8 @@ This search is to detect a suspicious modification of registry related to UAC by #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Privilege Escalation, Defense Evasion | diff --git a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md index bb45a86b9d..04ff2f179e 100644 --- a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md +++ b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-05 toc: true +toc_label: "" tags: - TTP - T1574.002 @@ -37,8 +38,8 @@ This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in no #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1574.002](https://attack.mitre.org/techniques/T1574/002/) | DLL Side-Loading | Persistence, Privilege Escalation, Defense Evasion | diff --git a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md index 92d1d35cfa..df03495eb4 100644 --- a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md +++ b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-05 toc: true +toc_label: "" tags: - TTP - T1562.001 @@ -35,8 +36,8 @@ This search is to identifies a modification in registry to disable the windows d #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | diff --git a/docs/_posts/2021-07-12-net_profiler_uac_bypass.md b/docs/_posts/2021-07-12-net_profiler_uac_bypass.md index 934ec6d6a3..63d0ace49f 100644 --- a/docs/_posts/2021-07-12-net_profiler_uac_bypass.md +++ b/docs/_posts/2021-07-12-net_profiler_uac_bypass.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-12 toc: true +toc_label: "" tags: - TTP - T1548.002 @@ -36,8 +37,8 @@ This search is to detect modification of registry to bypass UAC windows feature. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Privilege Escalation, Defense Evasion | diff --git a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md index 753356ae15..4f0fc6fd35 100644 --- a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md +++ b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-12 toc: true +toc_label: "" tags: - TTP - T1548.002 @@ -36,8 +37,8 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Privilege Escalation, Defense Evasion | diff --git a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md index a3933f7484..b8859f83c1 100644 --- a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md +++ b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-07-13 toc: true +toc_label: "" tags: - Anomaly - T1078.004 @@ -38,8 +39,8 @@ This search looks for cloud compute instances created by users who have not crea #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access | diff --git a/docs/_posts/2021-07-19-aws_createaccesskey.md b/docs/_posts/2021-07-19-aws_createaccesskey.md index 11d6e28965..0f03e49a55 100644 --- a/docs/_posts/2021-07-19-aws_createaccesskey.md +++ b/docs/_posts/2021-07-19-aws_createaccesskey.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-07-19 toc: true +toc_label: "" tags: - Hunting - T1136.003 @@ -35,8 +36,8 @@ This search looks for AWS CloudTrail events where a user A who has already permi #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1136.003](https://attack.mitre.org/techniques/T1136/003/) | Cloud Account | Persistence | diff --git a/docs/_posts/2021-07-19-aws_createloginprofile.md b/docs/_posts/2021-07-19-aws_createloginprofile.md index ca6704379a..c7bf324555 100644 --- a/docs/_posts/2021-07-19-aws_createloginprofile.md +++ b/docs/_posts/2021-07-19-aws_createloginprofile.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-07-19 toc: true +toc_label: "" tags: - TTP - T1136.003 @@ -35,8 +36,8 @@ This search looks for AWS CloudTrail events where a user A(victim A) creates a l #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1136.003](https://attack.mitre.org/techniques/T1136/003/) | Cloud Account | Persistence | diff --git a/docs/_posts/2021-07-19-aws_updateloginprofile.md b/docs/_posts/2021-07-19-aws_updateloginprofile.md index 4c5c0d7d61..a3b4b0d9e1 100644 --- a/docs/_posts/2021-07-19-aws_updateloginprofile.md +++ b/docs/_posts/2021-07-19-aws_updateloginprofile.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-07-19 toc: true +toc_label: "" tags: - TTP - T1136.003 @@ -35,8 +36,8 @@ This search looks for AWS CloudTrail events where a user A who has already permi #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1136.003](https://attack.mitre.org/techniques/T1136/003/) | Cloud Account | Persistence | diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md index 833c57cbcc..5aa9399ef8 100644 --- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md +++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-07-19 toc: true +toc_label: "" tags: - TTP - T1530 @@ -35,8 +36,8 @@ This search looks for AWS CloudTrail events where a user has created an open/pub #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection | diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md index 7666b0e2eb..6f5fe63a7a 100644 --- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md +++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-07-19 toc: true +toc_label: "" tags: - TTP - T1530 @@ -35,8 +36,8 @@ This search looks for AWS CloudTrail events where a user has created an open/pub #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection | diff --git a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md index 384acf6b8a..3f2c99e795 100644 --- a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md +++ b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-19 toc: true +toc_label: "" tags: - TTP - T1218.005 @@ -35,8 +36,8 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | diff --git a/docs/_posts/2021-07-19-o365_bypass_mfa_via_trusted_ip.md b/docs/_posts/2021-07-19-o365_bypass_mfa_via_trusted_ip.md index afaccd04ce..7b8da829c6 100644 --- a/docs/_posts/2021-07-19-o365_bypass_mfa_via_trusted_ip.md +++ b/docs/_posts/2021-07-19-o365_bypass_mfa_via_trusted_ip.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-07-19 toc: true +toc_label: "" tags: - TTP - T1562.007 @@ -35,8 +36,8 @@ This search detects newly added IP addresses/CIDR blocks to the list of MFA Trus #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.007](https://attack.mitre.org/techniques/T1562/007/) | Disable or Modify Cloud Firewall | Defense Evasion | diff --git a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md index 7bbbdc1463..8842e242a3 100644 --- a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md +++ b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-19 toc: true +toc_label: "" tags: - TTP - T1218.005 @@ -35,8 +36,8 @@ this search is to detect a suspicious office product process that spawn cmd chil #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | diff --git a/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md b/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md index a62602a1a0..9aa919acb6 100644 --- a/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md +++ b/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-07-20 toc: true +toc_label: "" tags: - TTP - T1537 @@ -35,8 +36,8 @@ The following analytic utilizes AWS CloudTrail events to identify when an EC2 sn #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1537](https://attack.mitre.org/techniques/T1537/) | Transfer Data to Cloud Account | Exfiltration | diff --git a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md index 883879d3f9..d5d936ed38 100644 --- a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md +++ b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-21 toc: true +toc_label: "" tags: - TTP - T1003.002 @@ -36,8 +37,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003.002](https://attack.mitre.org/techniques/T1003/002/) | Security Account Manager | Credential Access | diff --git a/docs/_posts/2021-07-23-sam_database_file_access_attempt.md b/docs/_posts/2021-07-23-sam_database_file_access_attempt.md index 782fd83f2c..fa08150c7b 100644 --- a/docs/_posts/2021-07-23-sam_database_file_access_attempt.md +++ b/docs/_posts/2021-07-23-sam_database_file_access_attempt.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-23 toc: true +toc_label: "" tags: - Hunting - T1003.002 @@ -35,8 +36,8 @@ The following analytic identifies access to SAM, SYSTEM or SECURITY databases #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003.002](https://attack.mitre.org/techniques/T1003/002/) | Security Account Manager | Credential Access | diff --git a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md index 2af54df8f3..7a575fad24 100644 --- a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md +++ b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-26 toc: true +toc_label: "" tags: - TTP - T1055 @@ -36,8 +37,8 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | diff --git a/docs/_posts/2021-07-26-rundll32_dnsquery.md b/docs/_posts/2021-07-26-rundll32_dnsquery.md index c005d60edb..6ff9d542e1 100644 --- a/docs/_posts/2021-07-26-rundll32_dnsquery.md +++ b/docs/_posts/2021-07-26-rundll32_dnsquery.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-26 toc: true +toc_label: "" tags: - TTP - T1218.011 @@ -35,8 +36,8 @@ This search is to detect a suspicious rundll32.exe process having a http connect #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | diff --git a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md index 1180878127..69407547e0 100644 --- a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md +++ b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-26 toc: true +toc_label: "" tags: - TTP - T1218.011 @@ -35,8 +36,8 @@ This search is to detect a suspicious rundll32 process that drops executable (.e #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | diff --git a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md index 994c61cce5..c6ee931414 100644 --- a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md +++ b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-26 toc: true +toc_label: "" tags: - TTP - T1218.011 @@ -35,8 +36,8 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | diff --git a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md index 19ff7b3df6..0ccdb4c52d 100644 --- a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md +++ b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-26 toc: true +toc_label: "" tags: - TTP - T1218.011 @@ -35,8 +36,8 @@ This search is to detect a suspicious rundll32.exe process with plugininit param #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | diff --git a/docs/_posts/2021-07-27-chcp_command_execution.md b/docs/_posts/2021-07-27-chcp_command_execution.md index 2b37996156..2b536aad74 100644 --- a/docs/_posts/2021-07-27-chcp_command_execution.md +++ b/docs/_posts/2021-07-27-chcp_command_execution.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-27 toc: true +toc_label: "" tags: - TTP - T1059 @@ -35,8 +36,8 @@ This search is to detect execution of chcp.exe application. this utility is used #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | diff --git a/docs/_posts/2021-07-27-suspicious_icedid_regsvr32_cmdline.md b/docs/_posts/2021-07-27-suspicious_icedid_regsvr32_cmdline.md index 302e141ba5..bb5b7dd6cf 100644 --- a/docs/_posts/2021-07-27-suspicious_icedid_regsvr32_cmdline.md +++ b/docs/_posts/2021-07-27-suspicious_icedid_regsvr32_cmdline.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-27 toc: true +toc_label: "" tags: - TTP - T1218.010 @@ -35,8 +36,8 @@ this search is to detect a suspicious regsvr32 commandline "-s" to execu #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.010](https://attack.mitre.org/techniques/T1218/010/) | Regsvr32 | Defense Evasion | diff --git a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md index 11911bdd6c..caf80025af 100644 --- a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md +++ b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-29 toc: true +toc_label: "" tags: - TTP - T1055 @@ -36,8 +37,8 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | diff --git a/docs/_posts/2021-07-30-drop_icedid_license_dat.md b/docs/_posts/2021-07-30-drop_icedid_license_dat.md index a89c6a1142..c9e4642fc3 100644 --- a/docs/_posts/2021-07-30-drop_icedid_license_dat.md +++ b/docs/_posts/2021-07-30-drop_icedid_license_dat.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-30 toc: true +toc_label: "" tags: - Hunting - T1204.002 @@ -35,8 +36,8 @@ This search is to detect dropping a suspicious file named as "license.dat #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1204.002](https://attack.mitre.org/techniques/T1204/002/) | Malicious File | Execution | diff --git a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md index aa7da3517d..eeb3675e0c 100644 --- a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md +++ b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-30 toc: true +toc_label: "" tags: - Hunting - T1560.001 @@ -35,8 +36,8 @@ This search is to detect a suspicious file creation namely passff.tar and cookie #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1560.001](https://attack.mitre.org/techniques/T1560/001/) | Archive via Utility | Collection | diff --git a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md index 0b3e76df6b..2b3a6eb92a 100644 --- a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md +++ b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-07-30 toc: true +toc_label: "" tags: - TTP - T1566.001 @@ -35,8 +36,8 @@ this detection was designed to identifies suspicious spawned process of known MS #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md index 9208400149..0949545b97 100644 --- a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md +++ b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-03 toc: true +toc_label: "" tags: - TTP - T1005 @@ -35,8 +36,8 @@ This search is to detect a suspicious file creation of sqlite3.dll in %temp% fol #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1005](https://attack.mitre.org/techniques/T1005/) | Data from Local System | Collection | diff --git a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md index 3b3dfb54a6..6fb090354b 100644 --- a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md +++ b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-04 toc: true +toc_label: "" tags: - TTP - T1055 @@ -36,8 +37,8 @@ This search is to detect suspicious process injection in command shell. This tec #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | diff --git a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md index 44456e3755..d16b9ce54a 100644 --- a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md +++ b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-09 toc: true +toc_label: "" tags: - TTP - T1218.007 @@ -35,8 +36,8 @@ This search is to detect a suspicious un-installation of application using msiex #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.007](https://attack.mitre.org/techniques/T1218/007/) | Msiexec | Defense Evasion | diff --git a/docs/_posts/2021-08-10-powershell_execute_com_object.md b/docs/_posts/2021-08-10-powershell_execute_com_object.md index acf2c06af6..03e85b4933 100644 --- a/docs/_posts/2021-08-10-powershell_execute_com_object.md +++ b/docs/_posts/2021-08-10-powershell_execute_com_object.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-10 toc: true +toc_label: "" tags: - TTP - T1546.015 @@ -36,8 +37,8 @@ This search is to detect a COM CLSID execution through powershell. This techniqu #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1546.015](https://attack.mitre.org/techniques/T1546/015/) | Component Object Model Hijacking | Privilege Escalation, Persistence | diff --git a/docs/_posts/2021-08-11-fsutil_zeroing_file.md b/docs/_posts/2021-08-11-fsutil_zeroing_file.md index dfbcee1ef4..db974b5bce 100644 --- a/docs/_posts/2021-08-11-fsutil_zeroing_file.md +++ b/docs/_posts/2021-08-11-fsutil_zeroing_file.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-11 toc: true +toc_label: "" tags: - TTP - T1070 @@ -35,8 +36,8 @@ This search is to detect a suspicious fsutil process to zeroing a target file. T #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | diff --git a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md index 498cf6d151..c0cc1c4199 100644 --- a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md +++ b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-13 toc: true +toc_label: "" tags: - TTP - T1218.003 @@ -35,8 +36,8 @@ This search is to detect a possible uac bypass using the colorui.dll COM Object. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.003](https://attack.mitre.org/techniques/T1218/003/) | CMSTP | Defense Evasion | diff --git a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md index 0957e2ab7b..afe54bd61a 100644 --- a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md +++ b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-08-16 toc: true +toc_label: "" tags: - Anomaly - T1567.002 @@ -35,8 +36,8 @@ This search is to detect suspicious google drive or google docs files shared out #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1567.002](https://attack.mitre.org/techniques/T1567/002/) | Exfiltration to Cloud Storage | Exfiltration | diff --git a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md index fb8eb01ecc..88c90cb58b 100644 --- a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md +++ b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-08-16 toc: true +toc_label: "" tags: - Anomaly - T1566.001 @@ -35,8 +36,8 @@ This search is to detect a suspicious attachment file extension in Gsuite email #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md index 56b4bcbf06..cb7e2ec3bb 100644 --- a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md +++ b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-17 toc: true +toc_label: "" tags: - Hunting - T1560.001 @@ -35,8 +36,8 @@ This search is to detect a suspicious 7z process with commandline pointing to SM #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1560.001](https://attack.mitre.org/techniques/T1560/001/) | Archive via Utility | Collection | diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md index c5c5f98a2e..6cf02a210a 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-08-17 toc: true +toc_label: "" tags: - TTP - T1204.003 @@ -35,8 +36,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1204.003](https://attack.mitre.org/techniques/T1204/003/) | Malicious Image | Execution | diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md index 3c5206f0c5..bbc82e334f 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-08-17 toc: true +toc_label: "" tags: - Hunting - T1204.003 @@ -35,8 +36,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1204.003](https://attack.mitre.org/techniques/T1204/003/) | Malicious Image | Execution | diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md index 2ae0753309..db241c2718 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-08-17 toc: true +toc_label: "" tags: - Anomaly - T1204.003 @@ -35,8 +36,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1204.003](https://attack.mitre.org/techniques/T1204/003/) | Malicious Image | Execution | diff --git a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md index 4f7c47edb4..c4d335254f 100644 --- a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md +++ b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-08-17 toc: true +toc_label: "" tags: - Anomaly - T1048.003 @@ -35,8 +36,8 @@ This search is to detect a suspicious outbound e-mail from internal email to ext #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration | diff --git a/docs/_posts/2021-08-18-esentutl_sam_copy.md b/docs/_posts/2021-08-18-esentutl_sam_copy.md index 0470bc6b1c..2a224f4adf 100644 --- a/docs/_posts/2021-08-18-esentutl_sam_copy.md +++ b/docs/_posts/2021-08-18-esentutl_sam_copy.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-18 toc: true +toc_label: "" tags: - Hunting - T1003.002 @@ -36,8 +37,8 @@ The following analytic identifies the process - `esentutl.exe` - being used to c #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003.002](https://attack.mitre.org/techniques/T1003/002/) | Security Account Manager | Credential Access | diff --git a/docs/_posts/2021-08-18-powershell_4104_hunting.md b/docs/_posts/2021-08-18-powershell_4104_hunting.md index 1b43426edd..01acaecee0 100644 --- a/docs/_posts/2021-08-18-powershell_4104_hunting.md +++ b/docs/_posts/2021-08-18-powershell_4104_hunting.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-18 toc: true +toc_label: "" tags: - Hunting - T1059.001 @@ -34,8 +35,8 @@ The following Hunting analytic assists with identifying suspicious PowerShell ex #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md index 61b3ff2988..25df3e4ad1 100644 --- a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md +++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-08-19 toc: true +toc_label: "" tags: - Anomaly - T1204.003 @@ -35,8 +36,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1204.003](https://attack.mitre.org/techniques/T1204/003/) | Malicious Image | Execution | diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md index c22f03258e..85015fc4b3 100644 --- a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md +++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-08-19 toc: true +toc_label: "" tags: - Anomaly - T1204.003 @@ -35,8 +36,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1204.003](https://attack.mitre.org/techniques/T1204/003/) | Malicious Image | Execution | diff --git a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md index cd8d86e04e..59fe798d36 100644 --- a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md +++ b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-08-19 toc: true +toc_label: "" tags: - Anomaly - T1566.001 @@ -35,8 +36,8 @@ This search is to detect a gsuite email contains suspicious subject having known #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md index cdf980888e..1c199a8a74 100644 --- a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md +++ b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md @@ -5,6 +5,7 @@ categories: - Network last_modified_at: 2021-08-19 toc: true +toc_label: "" tags: - TTP - Splunk Enterprise diff --git a/docs/_posts/2021-08-20-github_commit_changes_in_master.md b/docs/_posts/2021-08-20-github_commit_changes_in_master.md index 6a037955c2..9a3008715c 100644 --- a/docs/_posts/2021-08-20-github_commit_changes_in_master.md +++ b/docs/_posts/2021-08-20-github_commit_changes_in_master.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-08-20 toc: true +toc_label: "" tags: - Anomaly - T1199 @@ -35,8 +36,8 @@ This search is to detect a pushed or commit to master or main branch. This is to #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1199](https://attack.mitre.org/techniques/T1199/) | Trusted Relationship | Initial Access | diff --git a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md index 869181f3d5..d49b7629b1 100644 --- a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md +++ b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-08-20 toc: true +toc_label: "" tags: - TTP - T1212 @@ -35,8 +36,8 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect l #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1212](https://attack.mitre.org/techniques/T1212/) | Exploitation for Credential Access | Credential Access | diff --git a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md index bd645e49d5..eed0d2fc11 100644 --- a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md +++ b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-23 toc: true +toc_label: "" tags: - Hunting - T1087.001 @@ -35,8 +36,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | diff --git a/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md b/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md index 2e5bcafe7e..0f2ff9d6b9 100644 --- a/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md +++ b/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-23 toc: true +toc_label: "" tags: - Hunting - T1087.001 @@ -35,8 +36,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md index b294ac480f..9e78db3a6a 100644 --- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md +++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-23 toc: true +toc_label: "" tags: - Hunting - T1087.001 @@ -35,8 +36,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md index 00340b43fe..915829d14d 100644 --- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md +++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-23 toc: true +toc_label: "" tags: - Hunting - T1087.001 @@ -35,8 +36,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | diff --git a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md index 374abd88bb..6d4bd01d15 100644 --- a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md +++ b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-08-23 toc: true +toc_label: "" tags: - Anomaly - T1566.001 @@ -35,8 +36,8 @@ This analytics is to detect a gmail containing a link that are known to be abuse #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md index a639382237..4098eb80bb 100644 --- a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md +++ b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-08-23 toc: true +toc_label: "" tags: - Anomaly - T1566.001 @@ -35,8 +36,8 @@ This search is to detect a shared file in google drive with suspicious file name #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md index fa66bd1256..375fa22c8f 100644 --- a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md +++ b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-08-23 toc: true +toc_label: "" tags: - TTP - T1212 @@ -35,8 +36,8 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect r #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1212](https://attack.mitre.org/techniques/T1212/) | Exploitation for Credential Access | Credential Access | diff --git a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md index e8e728d060..113597705a 100644 --- a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md +++ b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-24 toc: true +toc_label: "" tags: - TTP - T1087.002 @@ -35,8 +36,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md index fd94761cf8..90275f24bf 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-24 toc: true +toc_label: "" tags: - Hunting - T1087.002 @@ -35,8 +36,8 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md index 3f0fe3ec86..65583237ad 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-24 toc: true +toc_label: "" tags: - TTP - T1087.002 @@ -35,8 +36,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md index fa7c08e392..b27f2d5725 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-24 toc: true +toc_label: "" tags: - TTP - T1087.002 @@ -35,8 +36,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md index 152c7daa77..cf98761d68 100644 --- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md +++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-24 toc: true +toc_label: "" tags: - TTP - T1482 @@ -35,8 +36,8 @@ This analytic identifies Get-DomainTrust from PowerView in order to gather domai #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md index c4013fc751..50deca2a20 100644 --- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-24 toc: true +toc_label: "" tags: - TTP - T1482 @@ -36,8 +37,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell.md b/docs/_posts/2021-08-24-get_aduser_with_powershell.md index eff0bb703a..599f00a72b 100644 --- a/docs/_posts/2021-08-24-get_aduser_with_powershell.md +++ b/docs/_posts/2021-08-24-get_aduser_with_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-24 toc: true +toc_label: "" tags: - Hunting - T1087.002 @@ -35,8 +36,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md index ddafa579d3..c189cc6d04 100644 --- a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-24 toc: true +toc_label: "" tags: - Hunting - T1087.002 @@ -35,8 +36,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | diff --git a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md index ed51c86908..9e90b67d91 100644 --- a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md +++ b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-24 toc: true +toc_label: "" tags: - TTP - T1087.002 @@ -35,8 +36,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | diff --git a/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md b/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md index 4c9d05247b..a0f8b7e199 100644 --- a/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-24 toc: true +toc_label: "" tags: - TTP - T1087.002 @@ -35,8 +36,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md index a93b21640d..f16c96080d 100644 --- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md +++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-24 toc: true +toc_label: "" tags: - TTP - T1087.002 @@ -35,8 +36,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md index 24e1873097..bcd37bd048 100644 --- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-24 toc: true +toc_label: "" tags: - TTP - T1087.002 @@ -35,8 +36,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | diff --git a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md index 158910fa7d..fab34c481e 100644 --- a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md +++ b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-08-24 toc: true +toc_label: "" tags: - TTP - T1526 @@ -35,8 +36,8 @@ This search uses the Kubernetes logs from Splunk Connect from Kubernetes to dete #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery | diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md index 36ace751d3..60269c375c 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-25 toc: true +toc_label: "" tags: - TTP - T1069.002 @@ -35,8 +36,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md index 456414eabb..35760654b0 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-25 toc: true +toc_label: "" tags: - Hunting - T1069.002 @@ -35,8 +36,8 @@ This analytic looks for the execution of `net.exe` with command-line arguments u #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md index 56cf246028..02d98a6413 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-25 toc: true +toc_label: "" tags: - Hunting - T1069.002 @@ -35,8 +36,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md index ce425acb8c..8895a3addb 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-25 toc: true +toc_label: "" tags: - TTP - T1069.002 @@ -35,8 +36,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-l #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md index c4c97e2900..c924ff245e 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-25 toc: true +toc_label: "" tags: - Hunting - T1069.002 @@ -35,8 +36,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md index 305bfccbc3..89d13a53fa 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-25 toc: true +toc_label: "" tags: - TTP - T1069.002 @@ -35,8 +36,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | diff --git a/docs/_posts/2021-08-25-getadgroup_with_powershell.md b/docs/_posts/2021-08-25-getadgroup_with_powershell.md index c6b1454aea..94ea59455b 100644 --- a/docs/_posts/2021-08-25-getadgroup_with_powershell.md +++ b/docs/_posts/2021-08-25-getadgroup_with_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-25 toc: true +toc_label: "" tags: - Hunting - T1069.002 @@ -35,8 +36,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | diff --git a/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md b/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md index c5a13d061f..c6028b8c4d 100644 --- a/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md +++ b/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-25 toc: true +toc_label: "" tags: - Hunting - T1069.002 @@ -35,8 +36,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | diff --git a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md index 3a5325c323..0a7469125f 100644 --- a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md +++ b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-25 toc: true +toc_label: "" tags: - TTP - T1069.002 @@ -35,8 +36,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | diff --git a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md index 00977a9971..5afdf70ee1 100644 --- a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md +++ b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-25 toc: true +toc_label: "" tags: - Hunting - T1049 @@ -35,8 +36,8 @@ This analytic looks for the execution of `powershell.exe` with command-line util #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1049](https://attack.mitre.org/techniques/T1049/) | System Network Connections Discovery | Discovery | diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md index bdf3d6abbe..26ad5c0f55 100644 --- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md +++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-25 toc: true +toc_label: "" tags: - TTP - T1069.002 @@ -35,8 +36,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md index 4ab08c707b..70648bb977 100644 --- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md +++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-25 toc: true +toc_label: "" tags: - TTP - T1069.002 @@ -35,8 +36,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | diff --git a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md index 5cab05779b..58ffb21214 100644 --- a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-26 toc: true +toc_label: "" tags: - Hunting - T1201 @@ -35,8 +36,8 @@ This analytic looks for the execution of `powershell.exe` executing the Get-ADDe #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery | diff --git a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md index f994f0e33f..f63e406433 100644 --- a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-26 toc: true +toc_label: "" tags: - Hunting - T1201 @@ -35,8 +36,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery | diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md index 1f615c1a68..f1988a561f 100644 --- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-26 toc: true +toc_label: "" tags: - TTP - T1201 @@ -35,8 +36,8 @@ This analytic looks for the execution of `powershell.exe` executing the Get ADUs #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery | diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md index 8ddd59d5a1..40ca4033da 100644 --- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-26 toc: true +toc_label: "" tags: - TTP - T1201 @@ -35,8 +36,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery | diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md index 7ff695ba8f..5e130c9dad 100644 --- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-26 toc: true +toc_label: "" tags: - TTP - T1201 @@ -35,8 +36,8 @@ This analytic looks for the execution of `powershell.exe` executing the `Get-Dom #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery | diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md index 4f573e72e1..db4105b581 100644 --- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-26 toc: true +toc_label: "" tags: - TTP - T1201 @@ -35,8 +36,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery | diff --git a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md index e24ce1dec4..ec48c51c03 100644 --- a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-26 toc: true +toc_label: "" tags: - TTP - T1069.002 @@ -35,8 +36,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | diff --git a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md index 7adf87cf6c..b424925778 100644 --- a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md +++ b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-26 toc: true +toc_label: "" tags: - Hunting - T1201 @@ -35,8 +36,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command li #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery | diff --git a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md index 7d81c3ccb7..da00993432 100644 --- a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md +++ b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-26 toc: true +toc_label: "" tags: - TTP - T1566.002 @@ -36,8 +37,8 @@ This search looks for a process launching an `*.lnk` file under `C:\User*` or `* #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.002](https://attack.mitre.org/techniques/T1566/002/) | Spearphishing Link | Initial Access | diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md index 8e4aef0fe9..f0fbdfa794 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md +++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-27 toc: true +toc_label: "" tags: - TTP - T1190 @@ -40,8 +41,8 @@ Review the source attempting to perform this activity against your environment. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | diff --git a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md index a01f805e9e..ff3d0d1d43 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md +++ b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-27 toc: true +toc_label: "" tags: - TTP - T1059.001 @@ -40,8 +41,8 @@ Module - New-managementroleassignment can assign a management role to a manageme #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | diff --git a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md index dc1efe812f..882b31a46c 100644 --- a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md +++ b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-30 toc: true +toc_label: "" tags: - TTP - T1018 @@ -35,8 +36,8 @@ This analytic looks for the execution of `nltest.exe` with command-line argument #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | diff --git a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md index 1762763770..487e64128b 100644 --- a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md +++ b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-30 toc: true +toc_label: "" tags: - Hunting - T1018 @@ -35,8 +36,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | diff --git a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md index 4cfee02b1c..91ba8ed436 100644 --- a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md +++ b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-31 toc: true +toc_label: "" tags: - TTP - T1187 @@ -38,8 +39,8 @@ During triage, review parallel security events to identify further suspicious ac #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1187](https://attack.mitre.org/techniques/T1187/) | Forced Authentication | Credential Access | diff --git a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md index 52bfb849b7..7d5dbd4086 100644 --- a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md +++ b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-31 toc: true +toc_label: "" tags: - TTP - T1003 @@ -35,8 +36,8 @@ The following analytic identifes Event Code 4768, A `Kerberos authentication tic #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | diff --git a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md index 31bbec8d32..140b140c82 100644 --- a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md +++ b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-08-31 toc: true +toc_label: "" tags: - Hunting - T1018 @@ -35,8 +36,8 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | diff --git a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md index 8ea996dc9a..d41dd8cf16 100644 --- a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md +++ b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-09-01 toc: true +toc_label: "" tags: - Anomaly - T1554 @@ -35,8 +36,8 @@ This search looks for disable security step in CircleCI pipeline. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1554](https://attack.mitre.org/techniques/T1554/) | Compromise Client Software Binary | Persistence | diff --git a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md index c8173af329..b1a79a87eb 100644 --- a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md +++ b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-01 toc: true +toc_label: "" tags: - Hunting - T1018 @@ -35,8 +36,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | diff --git a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md index d8685f5f7c..bc51a3bec2 100644 --- a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md +++ b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-01 toc: true +toc_label: "" tags: - Hunting - T1069.002 @@ -35,8 +36,8 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | diff --git a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md index 113610f114..2632204771 100644 --- a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-01 toc: true +toc_label: "" tags: - Hunting - T1018 @@ -35,8 +36,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | diff --git a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md index fccb7d5651..9e3a05534f 100644 --- a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-01 toc: true +toc_label: "" tags: - TTP - T1018 @@ -35,8 +36,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | diff --git a/docs/_posts/2021-09-01-github_commit_in_develop.md b/docs/_posts/2021-09-01-github_commit_in_develop.md index 93dffd3d91..95884508b8 100644 --- a/docs/_posts/2021-09-01-github_commit_in_develop.md +++ b/docs/_posts/2021-09-01-github_commit_in_develop.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-09-01 toc: true +toc_label: "" tags: - Anomaly - T1199 @@ -35,8 +36,8 @@ This search is to detect a pushed or commit to develop branch. This is to avoid #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1199](https://attack.mitre.org/techniques/T1199/) | Trusted Relationship | Initial Access | diff --git a/docs/_posts/2021-09-01-github_dependabot_alert.md b/docs/_posts/2021-09-01-github_dependabot_alert.md index ac60461556..3af3e9c1b1 100644 --- a/docs/_posts/2021-09-01-github_dependabot_alert.md +++ b/docs/_posts/2021-09-01-github_dependabot_alert.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-09-01 toc: true +toc_label: "" tags: - Anomaly - T1195.001 @@ -35,8 +36,8 @@ This search looks for Dependabot Alerts in Github logs. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1195.001](https://attack.mitre.org/techniques/T1195/001/) | Compromise Software Dependencies and Development Tools | Initial Access | diff --git a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md index 24be9ba7d1..6840e35bc1 100644 --- a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md +++ b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-09-01 toc: true +toc_label: "" tags: - Anomaly - T1195.001 @@ -35,8 +36,8 @@ This search looks for Pull Request from unknown user. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1195.001](https://attack.mitre.org/techniques/T1195/001/) | Compromise Software Dependencies and Development Tools | Initial Access | diff --git a/docs/_posts/2021-09-01-potential_pass_the_token_or_hash_observed_at_the_destination_device.md b/docs/_posts/2021-09-01-potential_pass_the_token_or_hash_observed_at_the_destination_device.md index 59899860c2..c7bc0cda31 100644 --- a/docs/_posts/2021-09-01-potential_pass_the_token_or_hash_observed_at_the_destination_device.md +++ b/docs/_posts/2021-09-01-potential_pass_the_token_or_hash_observed_at_the_destination_device.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-01 toc: true +toc_label: "" tags: - TTP - T1550.002 @@ -33,8 +34,8 @@ This detection identifies potential Pass the Token or Pass the Hash credential e #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1550.002](https://attack.mitre.org/techniques/T1550/002/) | Pass the Hash | Defense Evasion, Lateral Movement | diff --git a/docs/_posts/2021-09-01-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md b/docs/_posts/2021-09-01-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md index 811b92fd1a..ebf9b5c469 100644 --- a/docs/_posts/2021-09-01-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md +++ b/docs/_posts/2021-09-01-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-01 toc: true +toc_label: "" tags: - TTP - T1550.002 @@ -33,8 +34,8 @@ This detection identifies potential Pass the Token or Pass the Hash credential e #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1550.002](https://attack.mitre.org/techniques/T1550/002/) | Pass the Hash | Defense Evasion, Lateral Movement | diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md index 51b96b58d2..a3b088f082 100644 --- a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md +++ b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-01 toc: true +toc_label: "" tags: - TTP - T1018 @@ -35,8 +36,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md index 861ca762ba..7fd3d7d281 100644 --- a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md +++ b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-01 toc: true +toc_label: "" tags: - TTP - T1018 @@ -35,8 +36,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | diff --git a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md index c8a7d42bda..6e8307bed3 100644 --- a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md +++ b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-09-02 toc: true +toc_label: "" tags: - Anomaly - T1554 @@ -35,8 +36,8 @@ This search looks for disable security job in CircleCI pipeline. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1554](https://attack.mitre.org/techniques/T1554/) | Compromise Client Software Binary | Persistence | diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md index 60ae84000a..60f7e38e77 100644 --- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md +++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-02 toc: true +toc_label: "" tags: - TTP - T1482 @@ -35,8 +36,8 @@ This analytic identifies Get-ForestTrust from PowerSploit in order to gather dom #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md index 584c8c890e..595c5cce7a 100644 --- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-02 toc: true +toc_label: "" tags: - TTP - T1482 @@ -37,8 +38,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | diff --git a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md index a08e8b6d6b..09195b880e 100644 --- a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-02 toc: true +toc_label: "" tags: - TTP - T1018 @@ -35,8 +36,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | diff --git a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md index 243940b85b..9430c2961b 100644 --- a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-02 toc: true +toc_label: "" tags: - TTP - T1018 @@ -35,8 +36,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | diff --git a/docs/_posts/2021-09-06-add_defaultuser_and_password_in_registry.md b/docs/_posts/2021-09-06-add_defaultuser_and_password_in_registry.md index 08a6255af4..da3c1296a9 100644 --- a/docs/_posts/2021-09-06-add_defaultuser_and_password_in_registry.md +++ b/docs/_posts/2021-09-06-add_defaultuser_and_password_in_registry.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-06 toc: true +toc_label: "" tags: - Anomaly - T1552.002 @@ -35,8 +36,8 @@ this search is to detect a suspicious registry modification to implement auto ad #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1552.002](https://attack.mitre.org/techniques/T1552/002/) | Credentials in Registry | Credential Access | diff --git a/docs/_posts/2021-09-06-auto_admin_logon_registry_entry.md b/docs/_posts/2021-09-06-auto_admin_logon_registry_entry.md index f213559138..7d5ced6fe8 100644 --- a/docs/_posts/2021-09-06-auto_admin_logon_registry_entry.md +++ b/docs/_posts/2021-09-06-auto_admin_logon_registry_entry.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-06 toc: true +toc_label: "" tags: - TTP - T1552.002 @@ -35,8 +36,8 @@ this search is to detect a suspicious registry modification to implement auto ad #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1552.002](https://attack.mitre.org/techniques/T1552/002/) | Credentials in Registry | Credential Access | diff --git a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md index abc2850f0e..19ccb997ac 100644 --- a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md +++ b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-06 toc: true +toc_label: "" tags: - TTP - T1490 @@ -35,8 +36,8 @@ This search is to detect a suspicious bcdedit commandline to configure the host #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | diff --git a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md index c913692c54..552d28981d 100644 --- a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md +++ b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-06 toc: true +toc_label: "" tags: - TTP - T1490 @@ -35,8 +36,8 @@ This search is to detect a suspicious bcdedit commandline to configure the host #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | diff --git a/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md b/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md index a445c228f9..9e592fd06e 100644 --- a/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md +++ b/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-09-06 toc: true +toc_label: "" tags: - Correlation - T1204.003 @@ -35,8 +36,8 @@ This search correlations detections by repository and risk_score #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1204.003](https://attack.mitre.org/techniques/T1204/003/) | Malicious Image | Execution | diff --git a/docs/_posts/2021-09-06-correlation_by_user_and_risk.md b/docs/_posts/2021-09-06-correlation_by_user_and_risk.md index 999d1da54c..76320b98ef 100644 --- a/docs/_posts/2021-09-06-correlation_by_user_and_risk.md +++ b/docs/_posts/2021-09-06-correlation_by_user_and_risk.md @@ -5,6 +5,7 @@ categories: - Cloud last_modified_at: 2021-09-06 toc: true +toc_label: "" tags: - Correlation - T1204.003 @@ -35,8 +36,8 @@ This search correlations detections by user and risk_score #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1204.003](https://attack.mitre.org/techniques/T1204/003/) | Malicious Image | Execution | diff --git a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md index f34da9264f..fdd748e472 100644 --- a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md +++ b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-07 toc: true +toc_label: "" tags: - Hunting - T1018 @@ -35,8 +36,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | diff --git a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md index 7376a62277..93fc74d6de 100644 --- a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md +++ b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-07 toc: true +toc_label: "" tags: - TTP - T1018 @@ -35,8 +36,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | diff --git a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md index 5cfdaf92af..88acee3c86 100644 --- a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md +++ b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-07 toc: true +toc_label: "" tags: - Hunting - T1018 @@ -35,8 +36,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | diff --git a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md index 39fc54218c..fab867a91b 100644 --- a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md +++ b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-07 toc: true +toc_label: "" tags: - TTP - T1018 @@ -35,8 +36,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | diff --git a/docs/_posts/2021-09-07-registry_keys_used_for_persistence.md b/docs/_posts/2021-09-07-registry_keys_used_for_persistence.md index e5f4cb8d66..69bd0e80b5 100644 --- a/docs/_posts/2021-09-07-registry_keys_used_for_persistence.md +++ b/docs/_posts/2021-09-07-registry_keys_used_for_persistence.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-07 toc: true +toc_label: "" tags: - TTP - T1547.001 @@ -36,8 +37,8 @@ The search looks for modifications to registry keys that can be used to launch a #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1547.001](https://attack.mitre.org/techniques/T1547/001/) | Registry Run Keys / Startup Folder | Persistence, Privilege Escalation | diff --git a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md index d01b1ace1b..2cc6b26192 100644 --- a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md +++ b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-07 toc: true +toc_label: "" tags: - Anomaly - T1087.002 @@ -35,8 +36,8 @@ This analytic is to detect an application try to connect and create ADSI Object #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | diff --git a/docs/_posts/2021-09-07-system_information_discovery_detection.md b/docs/_posts/2021-09-07-system_information_discovery_detection.md index 1d921a4155..ddc432e85d 100644 --- a/docs/_posts/2021-09-07-system_information_discovery_detection.md +++ b/docs/_posts/2021-09-07-system_information_discovery_detection.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-07 toc: true +toc_label: "" tags: - TTP - T1082 @@ -35,8 +36,8 @@ Detect system information discovery techniques used by attackers to understand c #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1082](https://attack.mitre.org/techniques/T1082/) | System Information Discovery | Discovery | diff --git a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md index ea05c24f31..8a29f691c0 100644 --- a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md +++ b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-08 toc: true +toc_label: "" tags: - TTP - T1218.002 @@ -35,8 +36,8 @@ The following detection identifies control.exe loading either a .cpl or .inf fro #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.002](https://attack.mitre.org/techniques/T1218/002/) | Control Panel | Defense Evasion | diff --git a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md index e189afa5f2..0de244fcba 100644 --- a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md +++ b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-08 toc: true +toc_label: "" tags: - TTP - T1136.001 @@ -35,8 +36,8 @@ This search looks for the creation of local administrator accounts using net.exe #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1136.001](https://attack.mitre.org/techniques/T1136/001/) | Local Account | Persistence | diff --git a/docs/_posts/2021-09-08-office_spawning_control.md b/docs/_posts/2021-09-08-office_spawning_control.md index c889f86c13..39c365312a 100644 --- a/docs/_posts/2021-09-08-office_spawning_control.md +++ b/docs/_posts/2021-09-08-office_spawning_control.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-08 toc: true +toc_label: "" tags: - TTP - T1566.001 @@ -35,8 +36,8 @@ The following detection identifies control.exe spawning from an office product. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md index 26e300781c..290ae60171 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-08 toc: true +toc_label: "" tags: - Hunting - T1218.011 @@ -35,8 +36,8 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md index a543cd83c6..93ab573296 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-08 toc: true +toc_label: "" tags: - TTP - T1218.011 @@ -35,8 +36,8 @@ The following detection identifies rundll32.exe with `control_rundll` within the #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | diff --git a/docs/_posts/2021-09-09-extraction_of_registry_hives.md b/docs/_posts/2021-09-09-extraction_of_registry_hives.md index 850c5fc392..9a73c26ee8 100644 --- a/docs/_posts/2021-09-09-extraction_of_registry_hives.md +++ b/docs/_posts/2021-09-09-extraction_of_registry_hives.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-09 toc: true +toc_label: "" tags: - TTP - T1003.002 @@ -35,8 +36,8 @@ The following analytic identifies the use of `reg.exe` exporting Windows Registr #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003.002](https://attack.mitre.org/techniques/T1003/002/) | Security Account Manager | Credential Access | diff --git a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md index 637e9b9de7..8c389cb550 100644 --- a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md +++ b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-09 toc: true +toc_label: "" tags: - TTP - T1566.001 @@ -35,8 +36,8 @@ The following detection identifies the module load of mshtml.dll into an Office #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md index 872334ca6f..32b8ffd48f 100644 --- a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md +++ b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-10 toc: true +toc_label: "" tags: - Hunting - T1049 @@ -35,8 +36,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1049](https://attack.mitre.org/techniques/T1049/) | System Network Connections Discovery | Discovery | diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md index c63fff8c3b..3893990c8b 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-10 toc: true +toc_label: "" tags: - Hunting - T1049 @@ -35,8 +36,8 @@ This analytic looks for the execution of `arp.exe` utilized to get a listing of #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1049](https://attack.mitre.org/techniques/T1049/) | System Network Connections Discovery | Discovery | diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md index 7dae38e0d6..6fc8cb49a3 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-10 toc: true +toc_label: "" tags: - Hunting - T1049 @@ -35,8 +36,8 @@ This analytic looks for the execution of `net.exe` with command-line arguments u #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1049](https://attack.mitre.org/techniques/T1049/) | System Network Connections Discovery | Discovery | diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md index 8a35358015..d94410e5a4 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-10 toc: true +toc_label: "" tags: - Hunting - T1049 @@ -35,8 +36,8 @@ This analytic looks for the execution of `netstat.exe` with command-line argumen #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1049](https://attack.mitre.org/techniques/T1049/) | System Network Connections Discovery | Discovery | diff --git a/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md b/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md index d4e5858f6a..29f9d7c643 100644 --- a/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md +++ b/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-10 toc: true +toc_label: "" tags: - TTP - T1566.001 @@ -35,8 +36,8 @@ The following analytic identifies behavior related to CVE-2021-40444. Whereas th #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md index 5d9eed44e4..8016ffc0b8 100644 --- a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md +++ b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-13 toc: true +toc_label: "" tags: - Hunting - T1033 @@ -35,8 +36,8 @@ This analytic looks for the execution of `powerhsell.exe` with command-line argu #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | diff --git a/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md b/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md index f760ee4fa9..4c1dd58d3a 100644 --- a/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md +++ b/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-13 toc: true +toc_label: "" tags: - Hunting - T1033 @@ -35,8 +36,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | diff --git a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md index 603296a39a..c88df03de3 100644 --- a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md +++ b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-13 toc: true +toc_label: "" tags: - TTP - T1059.007 @@ -35,8 +36,8 @@ This search is to detect a execution of jscript using cscript process. Commonly #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript | Execution | diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md index 4022743642..517d55c240 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-13 toc: true +toc_label: "" tags: - Anomaly - T1059.007 @@ -35,8 +36,8 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript | Execution | diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md index 23c1c167d0..262b7a86d1 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-13 toc: true +toc_label: "" tags: - Anomaly - T1059.007 @@ -35,8 +36,8 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript | Execution | diff --git a/docs/_posts/2021-09-13-office_application_drop_executable.md b/docs/_posts/2021-09-13-office_application_drop_executable.md index 2cfe462b4a..f956024878 100644 --- a/docs/_posts/2021-09-13-office_application_drop_executable.md +++ b/docs/_posts/2021-09-13-office_application_drop_executable.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-13 toc: true +toc_label: "" tags: - TTP - T1566.001 @@ -35,8 +36,8 @@ This search is to detect a suspicious MS office application that drop or create #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_query.md b/docs/_posts/2021-09-13-system_user_discovery_with_query.md index 992c86b041..8cf8f11548 100644 --- a/docs/_posts/2021-09-13-system_user_discovery_with_query.md +++ b/docs/_posts/2021-09-13-system_user_discovery_with_query.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-13 toc: true +toc_label: "" tags: - Hunting - T1033 @@ -35,8 +36,8 @@ This analytic looks for the execution of `query.exe` with command-line arguments #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md index efb22c11a9..37c9340642 100644 --- a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md +++ b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-13 toc: true +toc_label: "" tags: - Hunting - T1033 @@ -35,8 +36,8 @@ This analytic looks for the execution of `whoami.exe` without any arguments. Thi #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | diff --git a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md index bd6603ee32..cc393ff833 100644 --- a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md +++ b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-13 toc: true +toc_label: "" tags: - Hunting - T1033 @@ -35,8 +36,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | diff --git a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md index 2fc6c89789..ea8b19ff67 100644 --- a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md +++ b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-13 toc: true +toc_label: "" tags: - Hunting - T1033 @@ -35,8 +36,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | diff --git a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md index 1d42f645cf..2b895861e7 100644 --- a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md +++ b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-13 toc: true +toc_label: "" tags: - TTP - T1220 @@ -35,8 +36,8 @@ This search is to detect a suspicious wmic.exe process or renamed wmic process t #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1220](https://attack.mitre.org/techniques/T1220/) | XSL Script Processing | Defense Evasion | diff --git a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md index f28dbb8cfb..e4b477a9ef 100644 --- a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md +++ b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-14 toc: true +toc_label: "" tags: - TTP - T1059.007 @@ -35,8 +36,8 @@ This search is to detect a suspicious parent process execution of commandline to #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript | Execution | diff --git a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md index ac1b95eb22..38763a11db 100644 --- a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md +++ b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-14 toc: true +toc_label: "" tags: - Hunting - T1069.001 @@ -35,8 +36,8 @@ The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | diff --git a/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md b/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md index 6c31021a1d..61927dd9fa 100644 --- a/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md +++ b/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-14 toc: true +toc_label: "" tags: - Hunting - T1069.001 @@ -36,8 +37,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | diff --git a/docs/_posts/2021-09-14-net_localgroup_discovery.md b/docs/_posts/2021-09-14-net_localgroup_discovery.md index 300aa1f149..bd1cf59262 100644 --- a/docs/_posts/2021-09-14-net_localgroup_discovery.md +++ b/docs/_posts/2021-09-14-net_localgroup_discovery.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-14 toc: true +toc_label: "" tags: - Hunting - T1069.001 @@ -35,8 +36,8 @@ The following hunting analytic will identify the use of localgroup discovery usi #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md index 95ab752d06..3b62f3329f 100644 --- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md +++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-14 toc: true +toc_label: "" tags: - Hunting - T1069.001 @@ -35,8 +36,8 @@ The following hunting analytic identifies the use of `get-localgroup` being used #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md index 005f2cde1b..2812dcf0ed 100644 --- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md +++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-14 toc: true +toc_label: "" tags: - Hunting - T1069.001 @@ -37,8 +38,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | diff --git a/docs/_posts/2021-09-14-wmic_group_discovery.md b/docs/_posts/2021-09-14-wmic_group_discovery.md index a872f36f96..728eccc346 100644 --- a/docs/_posts/2021-09-14-wmic_group_discovery.md +++ b/docs/_posts/2021-09-14-wmic_group_discovery.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-14 toc: true +toc_label: "" tags: - Hunting - T1069.001 @@ -37,8 +38,8 @@ During triage, review parallel processes and identify any further suspicious beh #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | diff --git a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md index f2ac209147..7caf49321b 100644 --- a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md +++ b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-15 toc: true +toc_label: "" tags: - TTP - T1033 @@ -35,8 +36,8 @@ This search is to detect a suspicious whoami execution to check if the cmd or sh #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | diff --git a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md index d5bfbe1928..af03104393 100644 --- a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md +++ b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-15 toc: true +toc_label: "" tags: - Anomaly - T1555.003 @@ -35,8 +36,8 @@ This search is to detect an anomaly event of non-chrome process accessing the fi #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1555.003](https://attack.mitre.org/techniques/T1555/003/) | Credentials from Web Browsers | Credential Access | diff --git a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md index a7dd1a1490..ddf32b3af1 100644 --- a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md +++ b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-15 toc: true +toc_label: "" tags: - Anomaly - T1555.003 @@ -35,8 +36,8 @@ This search is to detect an anomaly event of non-firefox process accessing the f #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1555.003](https://attack.mitre.org/techniques/T1555/003/) | Credentials from Web Browsers | Credential Access | diff --git a/docs/_posts/2021-09-16-account_discovery_with_net_app.md b/docs/_posts/2021-09-16-account_discovery_with_net_app.md index a953ef008d..3f3ced3e02 100644 --- a/docs/_posts/2021-09-16-account_discovery_with_net_app.md +++ b/docs/_posts/2021-09-16-account_discovery_with_net_app.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - TTP - T1087.002 @@ -35,8 +36,8 @@ this search is to detect a potential account discovery series of command used by #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery | diff --git a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md index c5e8f1fa75..17dcb34226 100644 --- a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md +++ b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - TTP - T1553.004 @@ -36,8 +37,8 @@ Attempt To Add Certificate To Untrusted Store #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1553.004](https://attack.mitre.org/techniques/T1553/004/) | Install Root Certificate | Defense Evasion | diff --git a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md index 0b96ec5e2f..fcc6793998 100644 --- a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md +++ b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - TTP - T1003.002 @@ -35,8 +36,8 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003.002](https://attack.mitre.org/techniques/T1003/002/) | Security Account Manager | Credential Access | diff --git a/docs/_posts/2021-09-16-batch_file_write_to_system32.md b/docs/_posts/2021-09-16-batch_file_write_to_system32.md index 4093ac4f60..af49ba77a6 100644 --- a/docs/_posts/2021-09-16-batch_file_write_to_system32.md +++ b/docs/_posts/2021-09-16-batch_file_write_to_system32.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - TTP - T1204.002 @@ -35,8 +36,8 @@ The search looks for a batch file (.bat) written to the Windows system directory #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1204.002](https://attack.mitre.org/techniques/T1204/002/) | Malicious File | Execution | diff --git a/docs/_posts/2021-09-16-bits_job_persistence.md b/docs/_posts/2021-09-16-bits_job_persistence.md index 668125c356..0bd833cf55 100644 --- a/docs/_posts/2021-09-16-bits_job_persistence.md +++ b/docs/_posts/2021-09-16-bits_job_persistence.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - TTP - T1197 @@ -36,8 +37,8 @@ The following query identifies Microsoft Background Intelligent Transfer Service #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1197](https://attack.mitre.org/techniques/T1197/) | BITS Jobs | Defense Evasion, Persistence | diff --git a/docs/_posts/2021-09-16-bitsadmin_download_file.md b/docs/_posts/2021-09-16-bitsadmin_download_file.md index 5facb7d77b..b2a095bd5f 100644 --- a/docs/_posts/2021-09-16-bitsadmin_download_file.md +++ b/docs/_posts/2021-09-16-bitsadmin_download_file.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - TTP - T1197 @@ -39,8 +40,8 @@ The following query identifies Microsoft Background Intelligent Transfer Service #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1197](https://attack.mitre.org/techniques/T1197/) | BITS Jobs | Defense Evasion, Persistence | | [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control | diff --git a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md index 76b9b6a1d3..231b300b44 100644 --- a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md +++ b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - TTP - T1003.003 @@ -35,8 +36,8 @@ This search detects the use of wmic and Powershell to create a shadow copy. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003.003](https://attack.mitre.org/techniques/T1003/003/) | NTDS | Credential Access | diff --git a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md index a314a324f3..22f74ed622 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - TTP - T1003.003 @@ -35,8 +36,8 @@ This search detects credential dumping using copy command from a shadow copy. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003.003](https://attack.mitre.org/techniques/T1003/003/) | NTDS | Credential Access | diff --git a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md index 22fcc25f45..2d28a7dbbc 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - TTP - T1003.003 @@ -35,8 +36,8 @@ This search detects the creation of a symlink to a shadow copy. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003.003](https://attack.mitre.org/techniques/T1003/003/) | NTDS | Credential Access | diff --git a/docs/_posts/2021-09-16-detect_html_help_renamed.md b/docs/_posts/2021-09-16-detect_html_help_renamed.md index 1b2a2ae4ea..94535c8421 100644 --- a/docs/_posts/2021-09-16-detect_html_help_renamed.md +++ b/docs/_posts/2021-09-16-detect_html_help_renamed.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - Hunting - T1218.001 @@ -35,8 +36,8 @@ The following analytic identifies a renamed instance of hh.exe (HTML Help) execu #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.001](https://attack.mitre.org/techniques/T1218/001/) | Compiled HTML File | Defense Evasion | diff --git a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md index 50332c9aef..a0a6e85c38 100644 --- a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - TTP - T1218.001 @@ -35,8 +36,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.001](https://attack.mitre.org/techniques/T1218/001/) | Compiled HTML File | Defense Evasion | diff --git a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md index b5b3526b1f..a2696a7605 100644 --- a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md +++ b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - TTP - T1218.001 @@ -35,8 +36,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.001](https://attack.mitre.org/techniques/T1218/001/) | Compiled HTML File | Defense Evasion | diff --git a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md index 2c42f4793b..9d80c21654 100644 --- a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md +++ b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - TTP - T1218.005 @@ -35,8 +36,8 @@ The following analytic identifies "mshta.exe" execution with inline prot #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | diff --git a/docs/_posts/2021-09-16-detect_mshta_renamed.md b/docs/_posts/2021-09-16-detect_mshta_renamed.md index 550cc5a455..a881084da7 100644 --- a/docs/_posts/2021-09-16-detect_mshta_renamed.md +++ b/docs/_posts/2021-09-16-detect_mshta_renamed.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - Hunting - T1218.005 @@ -35,8 +36,8 @@ The following analytic identifies renamed instances of mshta.exe executing. Msht #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | diff --git a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md index cb54051453..09f2b553ca 100644 --- a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - TTP - T1218.005 @@ -35,8 +36,8 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | diff --git a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md index 47608cdf9a..406a82c40d 100644 --- a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md +++ b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - TTP - T1021.002 @@ -35,8 +36,8 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement | diff --git a/docs/_posts/2021-09-16-detect_renamed_7-zip.md b/docs/_posts/2021-09-16-detect_renamed_7-zip.md index d339f516e8..5bfa53c9af 100644 --- a/docs/_posts/2021-09-16-detect_renamed_7-zip.md +++ b/docs/_posts/2021-09-16-detect_renamed_7-zip.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - Hunting - T1560.001 @@ -35,8 +36,8 @@ The following analytic identifies renamed 7-Zip usage using Sysmon. At this stag #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1560.001](https://attack.mitre.org/techniques/T1560/001/) | Archive via Utility | Collection | diff --git a/docs/_posts/2021-09-16-detect_renamed_psexec.md b/docs/_posts/2021-09-16-detect_renamed_psexec.md index df985eac4b..f14b652ac3 100644 --- a/docs/_posts/2021-09-16-detect_renamed_psexec.md +++ b/docs/_posts/2021-09-16-detect_renamed_psexec.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - Hunting - T1569.002 @@ -37,8 +38,8 @@ The following analytic identifies renamed instances of `PsExec.exe` being utiliz #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1569.002](https://attack.mitre.org/techniques/T1569/002/) | Service Execution | Execution | diff --git a/docs/_posts/2021-09-16-detect_renamed_rclone.md b/docs/_posts/2021-09-16-detect_renamed_rclone.md index 6fa059c807..f38e950d7d 100644 --- a/docs/_posts/2021-09-16-detect_renamed_rclone.md +++ b/docs/_posts/2021-09-16-detect_renamed_rclone.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - Hunting - T1020 @@ -34,8 +35,8 @@ The following analytic identifies the usage of `rclone.exe`, renamed, being used #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1020](https://attack.mitre.org/techniques/T1020/) | Automated Exfiltration | Exfiltration | diff --git a/docs/_posts/2021-09-16-detect_renamed_winrar.md b/docs/_posts/2021-09-16-detect_renamed_winrar.md index f8597bb423..35ca37e570 100644 --- a/docs/_posts/2021-09-16-detect_renamed_winrar.md +++ b/docs/_posts/2021-09-16-detect_renamed_winrar.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - Hunting - T1560.001 @@ -36,8 +37,8 @@ The following analtyic identifies renamed instances of `WinRAR.exe`. In most cas #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1560.001](https://attack.mitre.org/techniques/T1560/001/) | Archive via Utility | Collection | diff --git a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md index 880e58b4df..3ef511b647 100644 --- a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md +++ b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - TTP - T1003.001 @@ -36,8 +37,8 @@ During triage, confirm this is procdump.exe executing. If it is the first time a #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access | diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_net.md b/docs/_posts/2021-09-16-local_account_discovery_with_net.md index 9cbde6cabb..534dfb389e 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_net.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_net.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - Hunting - T1087.001 @@ -35,8 +36,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md index 869c2db717..e52353e196 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - Hunting - T1087.001 @@ -35,8 +36,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | diff --git a/docs/_posts/2021-09-16-office_product_spawning_wmic.md b/docs/_posts/2021-09-16-office_product_spawning_wmic.md index e062b1ce20..5ce30328ff 100644 --- a/docs/_posts/2021-09-16-office_product_spawning_wmic.md +++ b/docs/_posts/2021-09-16-office_product_spawning_wmic.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - TTP - T1566.001 @@ -35,8 +36,8 @@ The following detection identifies the latest behavior utilized by Ursnif malwar #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2021-09-16-processes_launching_netsh.md b/docs/_posts/2021-09-16-processes_launching_netsh.md index 8fb7d8404b..400a19493f 100644 --- a/docs/_posts/2021-09-16-processes_launching_netsh.md +++ b/docs/_posts/2021-09-16-processes_launching_netsh.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-16 toc: true +toc_label: "" tags: - TTP - T1562.004 @@ -35,8 +36,8 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1562.004](https://attack.mitre.org/techniques/T1562/004/) | Disable or Modify System Firewall | Defense Evasion | diff --git a/docs/_posts/2021-09-20-detect_regasm_with_no_command_line_arguments.md b/docs/_posts/2021-09-20-detect_regasm_with_no_command_line_arguments.md index 436cda6d99..29daeb29d8 100644 --- a/docs/_posts/2021-09-20-detect_regasm_with_no_command_line_arguments.md +++ b/docs/_posts/2021-09-20-detect_regasm_with_no_command_line_arguments.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-20 toc: true +toc_label: "" tags: - TTP - T1218.009 @@ -35,8 +36,8 @@ The following analytic identifies regasm.exe with no command line arguments. Thi #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | diff --git a/docs/_posts/2021-09-20-detect_regsvcs_with_no_command_line_arguments.md b/docs/_posts/2021-09-20-detect_regsvcs_with_no_command_line_arguments.md index 0778bf4b0b..869f008695 100644 --- a/docs/_posts/2021-09-20-detect_regsvcs_with_no_command_line_arguments.md +++ b/docs/_posts/2021-09-20-detect_regsvcs_with_no_command_line_arguments.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-20 toc: true +toc_label: "" tags: - TTP - T1218.009 @@ -35,8 +36,8 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | diff --git a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md index ec23e4ab8d..3aeb112778 100644 --- a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md +++ b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-20 toc: true +toc_label: "" tags: - TTP - T1566.001 @@ -35,8 +36,8 @@ This search is to detect potential malicious office document executing lolbin ch #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | diff --git a/docs/_posts/2021-09-20-suspicious_dllhost_no_command_line_arguments.md b/docs/_posts/2021-09-20-suspicious_dllhost_no_command_line_arguments.md index 1a4307a642..defc7b368c 100644 --- a/docs/_posts/2021-09-20-suspicious_dllhost_no_command_line_arguments.md +++ b/docs/_posts/2021-09-20-suspicious_dllhost_no_command_line_arguments.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-20 toc: true +toc_label: "" tags: - TTP - T1055 @@ -36,8 +37,8 @@ The following analytic identifies DLLHost.exe with no command line arguments. It #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | diff --git a/docs/_posts/2021-09-20-suspicious_gpupdate_no_command_line_arguments.md b/docs/_posts/2021-09-20-suspicious_gpupdate_no_command_line_arguments.md index 5032b4e6c0..0eb31db494 100644 --- a/docs/_posts/2021-09-20-suspicious_gpupdate_no_command_line_arguments.md +++ b/docs/_posts/2021-09-20-suspicious_gpupdate_no_command_line_arguments.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-20 toc: true +toc_label: "" tags: - TTP - T1055 @@ -36,8 +37,8 @@ The following analytic identifies gpupdate.exe with no command line arguments. I #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | diff --git a/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md b/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md index 974b36504a..b43daedddf 100644 --- a/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md +++ b/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-20 toc: true +toc_label: "" tags: - Hunting - T1127 @@ -38,8 +39,8 @@ The following analytic identifies a renamed instance of microsoft.workflow.compi #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1127](https://attack.mitre.org/techniques/T1127/) | Trusted Developer Utilities Proxy Execution | Defense Evasion | | [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | diff --git a/docs/_posts/2021-09-20-suspicious_rundll32_no_command_line_arguments.md b/docs/_posts/2021-09-20-suspicious_rundll32_no_command_line_arguments.md index 1e17d088d6..db121561bc 100644 --- a/docs/_posts/2021-09-20-suspicious_rundll32_no_command_line_arguments.md +++ b/docs/_posts/2021-09-20-suspicious_rundll32_no_command_line_arguments.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-20 toc: true +toc_label: "" tags: - TTP - T1218.011 @@ -35,8 +36,8 @@ The following analytic identifies rundll32.exe with no command line arguments. I #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | diff --git a/docs/_posts/2021-09-20-suspicious_searchprotocolhost_no_command_line_arguments.md b/docs/_posts/2021-09-20-suspicious_searchprotocolhost_no_command_line_arguments.md index 1c35561cd0..6c8349df28 100644 --- a/docs/_posts/2021-09-20-suspicious_searchprotocolhost_no_command_line_arguments.md +++ b/docs/_posts/2021-09-20-suspicious_searchprotocolhost_no_command_line_arguments.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-20 toc: true +toc_label: "" tags: - TTP - T1055 @@ -36,8 +37,8 @@ The following analytic identifies searchprotocolhost.exe with no command line ar #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | diff --git a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md index 75a96928bb..00e4f20c6d 100644 --- a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md +++ b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-21 toc: true +toc_label: "" tags: - TTP - T1113 @@ -35,8 +36,8 @@ This search is to detect file creation in remcos folder in appdata which is the #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1113](https://attack.mitre.org/techniques/T1113/) | Screen Capture | Collection | diff --git a/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md b/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md index 32d26ebd88..ffde824d49 100644 --- a/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md +++ b/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-21 toc: true +toc_label: "" tags: - TTP - T1113 @@ -35,8 +36,8 @@ This search is to detect a suspicious creation of image in appdata folder made b #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1113](https://attack.mitre.org/techniques/T1113/) | Screen Capture | Collection | diff --git a/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md b/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md index b401f28975..a50f345c8c 100644 --- a/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md +++ b/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-09-21 toc: true +toc_label: "" tags: - TTP - T1113 @@ -35,8 +36,8 @@ This analytic is to detect a suspicious creation of .wav file in appdata folder. #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1113](https://attack.mitre.org/techniques/T1113/) | Screen Capture | Collection | diff --git a/docs/_posts/2021-09-24-remcos_client_registry_install_entry.md b/docs/_posts/2021-09-24-remcos_client_registry_install_entry.md new file mode 100644 index 0000000000..7f6fa67816 --- /dev/null +++ b/docs/_posts/2021-09-24-remcos_client_registry_install_entry.md @@ -0,0 +1,103 @@ +--- +title: "Remcos client registry install entry" +excerpt: "Modify Registry" +categories: + - Endpoint +last_modified_at: 2021-09-24 +toc: true +toc_label: "" +tags: + - TTP + - T1112 + - Modify Registry + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +This search detects registry key license at host where Remcos RAT agent is installed. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-09-24 +- **Author**: Bhavin Patel, Rod Soto, Splunk +- **ID**: f2a1615a-1d63-11ec-97d2-acde48001122 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | +| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Registry.registry_path) as registry_path FROM datamodel=Endpoint.Registry where (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.dest Registry.user Registry.registry_key_name Registry.process_id +| `drop_dm_object_name(Registry)` +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +|`remcos_client_registry_install_entry_filter` +``` + +#### Associated Analytic Story +* [Remcos](/stories/remcos) + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field +* _time +* Registry.registry_path +* Registry.registry_key_name +* Registry.process_id +* Registry.dest +* Registry.user + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +unknown + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 90.0 | 90 | 100 | A registry entry $registry_path$ with registry keyname $registry_key_name$ related to Remcos RAT in host $dest$ | + + + +#### Reference + +* [https://attack.mitre.org/software/S0332/](https://attack.mitre.org/software/S0332/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_panel_client/remcos_registry_entry.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_panel_client/remcos_registry_entry.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/remcos_client_registry_install_entry.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-10-05-detect_exchange_web_shell.md b/docs/_posts/2021-10-05-detect_exchange_web_shell.md new file mode 100644 index 0000000000..98d1959118 --- /dev/null +++ b/docs/_posts/2021-10-05-detect_exchange_web_shell.md @@ -0,0 +1,110 @@ +--- +title: "Detect Exchange Web Shell" +excerpt: "Web Shell" +categories: + - Endpoint +last_modified_at: 2021-10-05 +toc: true +toc_label: "" +tags: + - TTP + - T1505.003 + - Web Shell + - Persistence + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant. + +- **Type**: TTP +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-10-05 +- **Author**: Michael Haag, Shannon Davis, David Dorsey, Splunk +- **ID**: 8c14eeee-2af1-4a4b-bda8-228da0f4862a + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | +| [T1505.003](https://attack.mitre.org/techniques/T1505/003/) | Web Shell | Persistence | + + +#### Search + +``` + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=System by _time span=1h Processes.process_id Processes.process_name Processes.dest +| `drop_dm_object_name(Processes)` +| join process_guid, _time [ +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path +| `drop_dm_object_name(Filesystem)` +| fields _time dest file_create_time file_name file_path process_name process_path process] +| dedup file_create_time +| table dest file_create_time, file_name, file_path, process_name +| `detect_exchange_web_shell_filter` +``` + +#### Associated Analytic Story +* [HAFNIUM Group](/stories/hafnium_group) +* [ProxyShell](/stories/proxyshell) + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. + +#### Required field +* _time +* Filesystem.file_path +* Filesystem.process_id +* Filesystem.file_name +* Filesystem.file_hash +* Filesystem.user + + +#### Kill Chain Phase +* Exploitation + + +#### Known False Positives +The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product. + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 81.0 | 90 | 90 | A file - $file_name$ was written to disk that is related to IIS exploitation previously performed by HAFNIUM. Review further file modifications on endpoint $dest$ by user $user$. | + + + +#### Reference + +* [https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv) +* [https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell](https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell) +* [https://www.youtube.com/watch?v=FC6iHw258RI](https://www.youtube.com/watch?v=FC6iHw258RI) +* [https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do](https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_exchange_web_shell.yml) \| *version*: **3** \ No newline at end of file diff --git a/docs/_posts/2021-10-05-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md b/docs/_posts/2021-10-05-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md new file mode 100644 index 0000000000..1077b13f7f --- /dev/null +++ b/docs/_posts/2021-10-05-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md @@ -0,0 +1,114 @@ +--- +title: "Malicious PowerShell Process - Connect To Internet With Hidden Window" +excerpt: "PowerShell" +categories: + - Endpoint +last_modified_at: 2021-10-05 +toc: true +toc_label: "" +tags: + - Hunting + - T1059.001 + - PowerShell + - Execution + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Command and Control + - Actions on Objectives +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +The following hunting analytic identifies PowerShell commands utilizing the WindowStyle parameter to hide the window on the compromised endpoint. This combination of command-line options is suspicious because it is overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet. Removed in this version of the query is New-Object. The analytic identifies all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter. For example w, win, windowsty and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. + +- **Type**: Hunting +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-10-05 +- **Author**: David Dorsey, Michael Haag Splunk +- **ID**: ee18ed37-0802-4268-9435-b3b91aaa18db + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | +| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | + + +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| where match(process,"(?i)[\- +|\/ +|– +|— +|―]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]") +| `malicious_powershell_process___connect_to_internet_with_hidden_window_filter` +``` + +#### Associated Analytic Story +* [Malicious PowerShell](/stories/malicious_powershell) +* [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns) +* [HAFNIUM Group](/stories/hafnium_group) + + +#### How To Implement +You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. + +#### Required field +* _time +* Processes.process +* Processes.process_name +* Processes.user +* Processes.parent_process_name +* Processes.dest + + +#### Kill Chain Phase +* Command and Control +* Actions on Objectives + + +#### Known False Positives +Legitimate process can have this combination of command-line options, but it's not common. + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 81.0 | 90 | 90 | PowerShell processes $process$ started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet on host $dest$ executed by user $user$. | + + + +#### Reference + +* [https://regexr.com/663rr](https://regexr.com/663rr) +* [https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1](https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1) +* [https://ss64.com/ps/powershell.html](https://ss64.com/ps/powershell.html) +* [https://twitter.com/M_haggis/status/1440758396534214658?s=20](https://twitter.com/M_haggis/status/1440758396534214658?s=20) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/malicious_powershell_process_-_connect_to_internet_with_hidden_window.yml) \| *version*: **7** \ No newline at end of file diff --git a/docs/_posts/2021-10-05-malicious_powershell_process_-_encoded_command.md b/docs/_posts/2021-10-05-malicious_powershell_process_-_encoded_command.md new file mode 100644 index 0000000000..81cd914441 --- /dev/null +++ b/docs/_posts/2021-10-05-malicious_powershell_process_-_encoded_command.md @@ -0,0 +1,118 @@ +--- +title: "Malicious PowerShell Process - Encoded Command" +excerpt: "Obfuscated Files or Information" +categories: + - Endpoint +last_modified_at: 2021-10-05 +toc: true +toc_label: "" +tags: + - Hunting + - T1027 + - Obfuscated Files or Information + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Command and Control + - Actions on Objectives +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies the use of the EncodedCommand PowerShell parameter. This is typically used by Administrators to run complex scripts, but commonly used by adversaries to hide their code. \ +The analytic identifies all variations of EncodedCommand, as PowerShell allows the ability to shorten the parameter. For example enc, enco, encod and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. \ +During triage, review parallel events to determine legitimacy. Tune as needed based on admin scripts in use. \ +Alternatively, may use regex per matching here https://regexr.com/662ov. + +- **Type**: Hunting +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2021-10-05 +- **Author**: David Dorsey, Michael Haag, Splunk +- **ID**: c4db14d9-7909-48b4-a054-aa14d89dbb19 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | +| [T1027](https://attack.mitre.org/techniques/T1027/) | Obfuscated Files or Information | Defense Evasion | + + + +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| where match(process,"(?i)[\- +|\/ +|– +|— +|―]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]") +| `malicious_powershell_process___encoded_command_filter` +``` + +#### Associated Analytic Story +* [Malicious PowerShell](/stories/malicious_powershell) +* [NOBELIUM Group](/stories/nobelium_group) + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Required field +* _time +* Processes.process_name +* Processes.process +* Processes.user +* Processes.parent_process_name +* Processes.dest +* Processes.process_id + + +#### Kill Chain Phase +* Command and Control +* Actions on Objectives + + +#### Known False Positives +System administrators may use this option, but it's not common. + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 35.0 | 70 | 50 | Powershell.exe running potentially malicious encodede commands on $dest$ | + + + +#### Reference + +* [https://regexr.com/662ov](https://regexr.com/662ov) +* [https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1](https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1) +* [https://ss64.com/ps/powershell.html](https://ss64.com/ps/powershell.html) +* [https://twitter.com/M_haggis/status/1440758396534214658?s=20](https://twitter.com/M_haggis/status/1440758396534214658?s=20) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/atomic_red_team/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/atomic_red_team/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/malicious_powershell_process_-_encoded_command.yml) \| *version*: **6** \ No newline at end of file diff --git a/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md b/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md new file mode 100644 index 0000000000..ac00e595e8 --- /dev/null +++ b/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md @@ -0,0 +1,104 @@ +--- +title: "DNS Query Length With High Standard Deviation" +excerpt: "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol" +categories: + - Network +last_modified_at: 2021-10-06 +toc: true +toc_label: "" +tags: + - Anomaly + - T1048.003 + - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol + - Exfiltration + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Network_Resolution + - Command and Control +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment. + +- **Type**: Anomaly +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) +- **Last Updated**: 2021-10-06 +- **Author**: Bhavin Patel, Splunk +- **ID**: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f5 + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | +| [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration | + + +#### Search + +``` + +| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where NOT DNS.message_type IN("Pointer","PTR") by DNS.query +| `drop_dm_object_name("DNS")` +| eval tlds=split(query,".") +| eval tld=mvindex(tlds,-1) +| eval tld_len=len(tld) +| search tld_len<=24 +| eval query_length = len(query) +| table query query_length record_type count +| eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50 +| where query_length>(avg+stdev*2) +| eval z_score=(query_length-avg)/stdev +| `dns_query_length_with_high_standard_deviation_filter` +``` + +#### Associated Analytic Story +* [Hidden Cobra Malware](/stories/hidden_cobra_malware) +* [Suspicious DNS Traffic](/stories/suspicious_dns_traffic) +* [Command and Control](/stories/command_and_control) + + +#### How To Implement +To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. + +#### Required field +* _time +* DNS.query + + +#### Kill Chain Phase +* Command and Control + + +#### Known False Positives +It's possible there can be long domain names that are legitimate. + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 56.0 | 70 | 80 | A dns query $query$ with 2 time standard deviation of name len of the dns query in host $host$ | + + + +#### Reference + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/long_dns_queries/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/long_dns_queries/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/network/dns_query_length_with_high_standard_deviation.yml) \| *version*: **4** \ No newline at end of file diff --git a/docs/_posts/2021-2-1-first_time_seen_command_line_argument.md b/docs/_posts/2021-2-1-first_time_seen_command_line_argument.md index 691a3c6c13..358b672ba6 100644 --- a/docs/_posts/2021-2-1-first_time_seen_command_line_argument.md +++ b/docs/_posts/2021-2-1-first_time_seen_command_line_argument.md @@ -5,6 +5,7 @@ categories: - Endpoint last_modified_at: 2021-2-1 toc: true +toc_label: "" tags: - Anomaly - T1059 @@ -38,8 +39,8 @@ This search looks for command-line arguments that use a `/c` parameter to execut #### ATT&CK -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| +| ID | Technique | Tactic | +| ----------- | ----------- | -------------- | | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | | [T1117](https://attack.mitre.org/techniques/T1117/) | Regsvr32 | | | [T1202](https://attack.mitre.org/techniques/T1202/) | Indirect Command Execution | Defense Evasion | diff --git a/docs/_stories/active_directory_discovery.md b/docs/_stories/active_directory_discovery.md index 6e4f67cbac..ca8a94e001 100644 --- a/docs/_stories/active_directory_discovery.md +++ b/docs/_stories/active_directory_discovery.md @@ -2,6 +2,7 @@ title: "Active Directory Discovery" last_modified_at: 2021-08-20 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -30,8 +31,8 @@ Once an attacker obtains an initial foothold in an Active Directory environment, | Name | Technique | Type | | ----------- | ----------- |--------------| -| [AdsiSearcher Account Discovery](/endpoint/adsisearcher_account_discovery/) | [Domain Account](/tags/#domain-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote System Discovery](/tags/#remote-system-discovery), [Domain Groups](/tags/#domain-groups), [Password Policy Discovery](/tags/#password-policy-discovery), [Local Groups](/tags/#local-groups), [System Owner/User Discovery](/tags/#system-owner/user-discovery), [Local Account](/tags/#local-account), [System Network Connections Discovery](/tags/#system-network-connections-discovery) | TTP | -| [DSQuery Domain Discovery](/endpoint/dsquery_domain_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote System Discovery](/tags/#remote-system-discovery) | TTP | +| [AdsiSearcher Account Discovery](/endpoint/adsisearcher_account_discovery/) | [Domain Account](/tags/#domain-account) | TTP | +| [DSQuery Domain Discovery](/endpoint/dsquery_domain_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | | [Domain Account Discovery With Net App](/endpoint/domain_account_discovery_with_net_app/) | [Domain Account](/tags/#domain-account) | TTP | | [Domain Account Discovery with Dsquery](/endpoint/domain_account_discovery_with_dsquery/) | [Domain Account](/tags/#domain-account) | Hunting | | [Domain Account Discovery with Wmic](/endpoint/domain_account_discovery_with_wmic/) | [Domain Account](/tags/#domain-account) | TTP | diff --git a/docs/_stories/active_directory_password_spraying.md b/docs/_stories/active_directory_password_spraying.md index fcf6f25ba9..ba1d5d7643 100644 --- a/docs/_stories/active_directory_password_spraying.md +++ b/docs/_stories/active_directory_password_spraying.md @@ -2,6 +2,7 @@ title: "Active Directory Password Spraying" last_modified_at: 2021-04-07 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/apache_struts_vulnerability.md b/docs/_stories/apache_struts_vulnerability.md index b0b7b1f589..ca8f307c8b 100644 --- a/docs/_stories/apache_struts_vulnerability.md +++ b/docs/_stories/apache_struts_vulnerability.md @@ -2,6 +2,7 @@ title: "Apache Struts Vulnerability" last_modified_at: 2018-12-06 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/asset_tracking.md b/docs/_stories/asset_tracking.md index 770f469f30..e8b909c3f8 100644 --- a/docs/_stories/asset_tracking.md +++ b/docs/_stories/asset_tracking.md @@ -2,6 +2,7 @@ title: "Asset Tracking" last_modified_at: 2017-09-13 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/aws_cross_account_activity.md b/docs/_stories/aws_cross_account_activity.md index 2f1cd7b2d3..6fffcee516 100644 --- a/docs/_stories/aws_cross_account_activity.md +++ b/docs/_stories/aws_cross_account_activity.md @@ -2,6 +2,7 @@ title: "AWS Cross Account Activity" last_modified_at: 2018-06-04 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -30,7 +31,7 @@ This Analytic Story includes searches that will help you monitor your AWS CloudT | Name | Technique | Type | | ----------- | ----------- |--------------| -| [aws detect attach to role policy](/cloud/aws_detect_attach_to_role_policy/) | [Valid Accounts](/tags/#valid-accounts), [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material) | Hunting | +| [aws detect attach to role policy](/cloud/aws_detect_attach_to_role_policy/) | [Valid Accounts](/tags/#valid-accounts) | Hunting | | [aws detect permanent key creation](/cloud/aws_detect_permanent_key_creation/) | [Valid Accounts](/tags/#valid-accounts) | Hunting | | [aws detect role creation](/cloud/aws_detect_role_creation/) | [Valid Accounts](/tags/#valid-accounts) | Hunting | | [aws detect sts assume role abuse](/cloud/aws_detect_sts_assume_role_abuse/) | [Valid Accounts](/tags/#valid-accounts) | Hunting | diff --git a/docs/_stories/aws_iam_privilege_escalation.md b/docs/_stories/aws_iam_privilege_escalation.md index a7247f91c8..8fb7923022 100644 --- a/docs/_stories/aws_iam_privilege_escalation.md +++ b/docs/_stories/aws_iam_privilege_escalation.md @@ -2,6 +2,7 @@ title: "AWS IAM Privilege Escalation" last_modified_at: 2021-03-08 toc: true +toc_label: "" tags: - Splunk Security Analytics for AWS - Splunk Enterprise @@ -30,7 +31,7 @@ However, if these IAM policies are misconfigured and have specific combinations | Name | Technique | Type | | ----------- | ----------- |--------------| -| [AWS Create Policy Version to allow all resources](/cloud/aws_create_policy_version_to_allow_all_resources/) | [Cloud Accounts](/tags/#cloud-accounts), [Cloud Account](/tags/#cloud-account), [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [Brute Force](/tags/#brute-force), [Account Manipulation](/tags/#account-manipulation), [Cloud Groups](/tags/#cloud-groups) | TTP | +| [AWS Create Policy Version to allow all resources](/cloud/aws_create_policy_version_to_allow_all_resources/) | [Cloud Accounts](/tags/#cloud-accounts) | TTP | | [AWS CreateAccessKey](/cloud/aws_createaccesskey/) | [Cloud Account](/tags/#cloud-account) | Hunting | | [AWS CreateLoginProfile](/cloud/aws_createloginprofile/) | [Cloud Account](/tags/#cloud-account) | TTP | | [AWS IAM Assume Role Policy Brute Force](/cloud/aws_iam_assume_role_policy_brute_force/) | [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [Brute Force](/tags/#brute-force) | TTP | diff --git a/docs/_stories/aws_network_acl_activity.md b/docs/_stories/aws_network_acl_activity.md index bc781dde9e..ccbfb85386 100644 --- a/docs/_stories/aws_network_acl_activity.md +++ b/docs/_stories/aws_network_acl_activity.md @@ -2,6 +2,7 @@ title: "AWS Network ACL Activity" last_modified_at: 2018-05-21 toc: true +toc_label: "" tags: - Splunk Security Analytics for AWS - Splunk Enterprise diff --git a/docs/_stories/aws_security_hub_alerts.md b/docs/_stories/aws_security_hub_alerts.md index 4fd2fd5989..5ca7a8fa58 100644 --- a/docs/_stories/aws_security_hub_alerts.md +++ b/docs/_stories/aws_security_hub_alerts.md @@ -2,6 +2,7 @@ title: "AWS Security Hub Alerts" last_modified_at: 2020-08-04 toc: true +toc_label: "" tags: - Splunk Security Analytics for AWS - Splunk Enterprise diff --git a/docs/_stories/aws_user_monitoring.md b/docs/_stories/aws_user_monitoring.md index 7e83af43a5..37ff25e044 100644 --- a/docs/_stories/aws_user_monitoring.md +++ b/docs/_stories/aws_user_monitoring.md @@ -2,6 +2,7 @@ title: "AWS User Monitoring" last_modified_at: 2018-03-12 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/baron_samedit_cve-2021-3156.md b/docs/_stories/baron_samedit_cve-2021-3156.md index f13cff9b63..e4d963063c 100644 --- a/docs/_stories/baron_samedit_cve-2021-3156.md +++ b/docs/_stories/baron_samedit_cve-2021-3156.md @@ -2,6 +2,7 @@ title: "Baron Samedit CVE-2021-3156" last_modified_at: 2021-01-27 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/bits_jobs.md b/docs/_stories/bits_jobs.md index 298aae0461..2d1b43042e 100644 --- a/docs/_stories/bits_jobs.md +++ b/docs/_stories/bits_jobs.md @@ -2,6 +2,7 @@ title: "BITS Jobs" last_modified_at: 2021-03-26 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -29,7 +30,7 @@ Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, async | Name | Technique | Type | | ----------- | ----------- |--------------| -| [BITS Job Persistence](/endpoint/bits_job_persistence/) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | +| [BITS Job Persistence](/endpoint/bits_job_persistence/) | [BITS Jobs](/tags/#bits-jobs) | TTP | | [BITSAdmin Download File](/endpoint/bitsadmin_download_file/) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | | [PowerShell Start-BitsTransfer](/endpoint/powershell_start-bitstransfer/) | [BITS Jobs](/tags/#bits-jobs) | TTP | diff --git a/docs/_stories/blackmatter_ransomware.md b/docs/_stories/blackmatter_ransomware.md index 250ce95b19..ad3881edd0 100644 --- a/docs/_stories/blackmatter_ransomware.md +++ b/docs/_stories/blackmatter_ransomware.md @@ -2,6 +2,7 @@ title: "BlackMatter Ransomware" last_modified_at: 2021-09-06 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -23,13 +24,13 @@ Leverage searches that allow you to detect and investigate unusual activities th #### Narrative -blackMatter ransomware campaigns targeting healthcare and other vertical sectors, involve the use of ransomware payloads along with exfiltration of data per HHS bulletin. Malicious actors demand payment for ransome of data and threaten deletion and exposure of exfiltrated data. +BlackMatter ransomware campaigns targeting healthcare and other vertical sectors, involve the use of ransomware payloads along with exfiltration of data per HHS bulletin. Malicious actors demand payment for ransome of data and threaten deletion and exposure of exfiltrated data. #### Detections | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Add DefaultUser And Password In Registry](/endpoint/add_defaultuser_and_password_in_registry/) | [Credentials in Registry](/tags/#credentials-in-registry), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Defacement](/tags/#defacement), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | Anomaly | +| [Add DefaultUser And Password In Registry](/endpoint/add_defaultuser_and_password_in_registry/) | [Credentials in Registry](/tags/#credentials-in-registry) | Anomaly | | [Auto Admin Logon Registry Entry](/endpoint/auto_admin_logon_registry_entry/) | [Credentials in Registry](/tags/#credentials-in-registry) | TTP | | [Bcdedit Command Back To Normal Mode Boot](/endpoint/bcdedit_command_back_to_normal_mode_boot/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [Change To Safe Mode With Network Config](/endpoint/change_to_safe_mode_with_network_config/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | diff --git a/docs/_stories/brand_monitoring.md b/docs/_stories/brand_monitoring.md index e941b8d622..44e1cbd2ff 100644 --- a/docs/_stories/brand_monitoring.md +++ b/docs/_stories/brand_monitoring.md @@ -2,6 +2,7 @@ title: "Brand Monitoring" last_modified_at: 2017-12-19 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/clop_ransomware.md b/docs/_stories/clop_ransomware.md index 3b22b8a56f..dafc23a2a3 100644 --- a/docs/_stories/clop_ransomware.md +++ b/docs/_stories/clop_ransomware.md @@ -2,6 +2,7 @@ title: "Clop Ransomware" last_modified_at: 2021-03-17 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -29,12 +30,12 @@ Clop ransomware campaigns targeting healthcare and other vertical sectors, invol | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Clop Common Exec Parameter](/endpoint/clop_common_exec_parameter/) | [User Execution](/tags/#user-execution), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Data Destruction](/tags/#data-destruction), [Service Execution](/tags/#service-execution), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Service Stop](/tags/#service-stop), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Clop Common Exec Parameter](/endpoint/clop_common_exec_parameter/) | [User Execution](/tags/#user-execution) | TTP | | [Clop Ransomware Known Service Name](/endpoint/clop_ransomware_known_service_name/) | [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | | [Common Ransomware Extensions](/endpoint/common_ransomware_extensions/) | [Data Destruction](/tags/#data-destruction) | Hunting | | [Common Ransomware Notes](/endpoint/common_ransomware_notes/) | [Data Destruction](/tags/#data-destruction) | Hunting | | [Create Service In Suspicious File Path](/endpoint/create_service_in_suspicious_file_path/) | [Service Execution](/tags/#service-execution) | TTP | -| [Deleting Shadow Copies](/endpoint/deleting_shadow_copies/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Deleting Shadow Copies](/endpoint/deleting_shadow_copies/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [High File Deletion Frequency](/endpoint/high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | Anomaly | | [High Process Termination Frequency](/endpoint/high_process_termination_frequency/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | Anomaly | | [Process Deleting Its Process File Path](/endpoint/process_deleting_its_process_file_path/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | diff --git a/docs/_stories/cloud_cryptomining.md b/docs/_stories/cloud_cryptomining.md index 4a9e798768..07394ba9a3 100644 --- a/docs/_stories/cloud_cryptomining.md +++ b/docs/_stories/cloud_cryptomining.md @@ -2,6 +2,7 @@ title: "Cloud Cryptomining" last_modified_at: 2019-10-02 toc: true +toc_label: "" tags: - Splunk Security Analytics for AWS - Splunk Enterprise @@ -33,7 +34,7 @@ This Analytic Story is focused on detecting suspicious new instances in your clo | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Abnormally High Number Of Cloud Instances Launched](/cloud/abnormally_high_number_of_cloud_instances_launched/) | [Cloud Accounts](/tags/#cloud-accounts), [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | Anomaly | +| [Abnormally High Number Of Cloud Instances Launched](/cloud/abnormally_high_number_of_cloud_instances_launched/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | | [Cloud Compute Instance Created By Previously Unseen User](/cloud/cloud_compute_instance_created_by_previously_unseen_user/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | | [Cloud Compute Instance Created In Previously Unused Region](/cloud/cloud_compute_instance_created_in_previously_unused_region/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | Anomaly | | [Cloud Compute Instance Created With Previously Unseen Image](/cloud/cloud_compute_instance_created_with_previously_unseen_image/) | | Anomaly | diff --git a/docs/_stories/cloud_federated_credential_abuse.md b/docs/_stories/cloud_federated_credential_abuse.md index f1a3e7ac07..a9011cd822 100644 --- a/docs/_stories/cloud_federated_credential_abuse.md +++ b/docs/_stories/cloud_federated_credential_abuse.md @@ -2,6 +2,7 @@ title: "Cloud Federated Credential Abuse" last_modified_at: 2021-01-26 toc: true +toc_label: "" tags: - Splunk Security Analytics for AWS - Splunk Enterprise @@ -30,7 +31,7 @@ This story is composed of detection searches based on endpoint that addresses th | Name | Technique | Type | | ----------- | ----------- |--------------| -| [AWS SAML Access by Provider User and Principal](/cloud/aws_saml_access_by_provider_user_and_principal/) | [Valid Accounts](/tags/#valid-accounts), [LSASS Memory](/tags/#lsass-memory), [Cloud Account](/tags/#cloud-account), [Modify Authentication Process](/tags/#modify-authentication-process), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | Anomaly | +| [AWS SAML Access by Provider User and Principal](/cloud/aws_saml_access_by_provider_user_and_principal/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly | | [AWS SAML Update identity provider](/cloud/aws_saml_update_identity_provider/) | [Valid Accounts](/tags/#valid-accounts) | TTP | | [Certutil exe certificate extraction](/endpoint/certutil_exe_certificate_extraction/) | | TTP | | [Detect Mimikatz Using Loaded Images](/endpoint/detect_mimikatz_using_loaded_images/) | [LSASS Memory](/tags/#lsass-memory) | TTP | diff --git a/docs/_stories/cobalt_strike.md b/docs/_stories/cobalt_strike.md index c65ee96b72..cd97df804b 100644 --- a/docs/_stories/cobalt_strike.md +++ b/docs/_stories/cobalt_strike.md @@ -2,6 +2,7 @@ title: "Cobalt Strike" last_modified_at: 2021-02-16 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -38,7 +39,7 @@ While investigating a detection related to this Analytic Story, keep in mind the | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Anomalous usage of 7zip](/endpoint/anomalous_usage_of_7zip/) | [Archive via Utility](/tags/#archive-via-utility), [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service), [Process Injection](/tags/#process-injection), [File Transfer Protocols](/tags/#file-transfer-protocols), [Regsvr32](/tags/#regsvr32), [Mshta](/tags/#mshta), [Service Execution](/tags/#service-execution), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Rundll32](/tags/#rundll32), [Scheduled Task](/tags/#scheduled-task), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Web Shell](/tags/#web-shell), [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Web Protocols](/tags/#web-protocols), [Remote System Discovery](/tags/#remote-system-discovery) | Anomaly | +| [Anomalous usage of 7zip](/endpoint/anomalous_usage_of_7zip/) | [Archive via Utility](/tags/#archive-via-utility) | Anomaly | | [CMD Echo Pipe - Escalation](/endpoint/cmd_echo_pipe_-_escalation/) | [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service) | TTP | | [Cobalt Strike Named Pipes](/endpoint/cobalt_strike_named_pipes/) | [Process Injection](/tags/#process-injection) | TTP | | [DLLHost with no Command Line Arguments with Network](/endpoint/dllhost_with_no_command_line_arguments_with_network/) | [Process Injection](/tags/#process-injection) | TTP | diff --git a/docs/_stories/coldroot_macos_rat.md b/docs/_stories/coldroot_macos_rat.md index 3e5cf6847d..f426bd03d7 100644 --- a/docs/_stories/coldroot_macos_rat.md +++ b/docs/_stories/coldroot_macos_rat.md @@ -2,6 +2,7 @@ title: "ColdRoot MacOS RAT" last_modified_at: 2019-01-09 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/collection_and_staging.md b/docs/_stories/collection_and_staging.md index 08f78aa545..0f2a54e40c 100644 --- a/docs/_stories/collection_and_staging.md +++ b/docs/_stories/collection_and_staging.md @@ -2,6 +2,7 @@ title: "Collection and Staging" last_modified_at: 2020-02-03 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -32,7 +33,7 @@ Use the searches to detect and monitor suspicious behavior related to these acti | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect Renamed 7-Zip](/endpoint/detect_renamed_7-zip/) | [Archive via Utility](/tags/#archive-via-utility), [Local Email Collection](/tags/#local-email-collection), [Remote Email Collection](/tags/#remote-email-collection), [Masquerading](/tags/#masquerading) | Hunting | +| [Detect Renamed 7-Zip](/endpoint/detect_renamed_7-zip/) | [Archive via Utility](/tags/#archive-via-utility) | Hunting | | [Detect Renamed WinRAR](/endpoint/detect_renamed_winrar/) | [Archive via Utility](/tags/#archive-via-utility) | Hunting | | [Email files written outside of the Outlook directory](/application/email_files_written_outside_of_the_outlook_directory/) | [Local Email Collection](/tags/#local-email-collection) | TTP | | [Email servers sending high volume traffic to hosts](/application/email_servers_sending_high_volume_traffic_to_hosts/) | [Remote Email Collection](/tags/#remote-email-collection) | Anomaly | diff --git a/docs/_stories/command_and_control.md b/docs/_stories/command_and_control.md index 6e91526090..a4eaa25b5b 100644 --- a/docs/_stories/command_and_control.md +++ b/docs/_stories/command_and_control.md @@ -2,6 +2,7 @@ title: "Command and Control" last_modified_at: 2018-06-01 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -32,7 +33,7 @@ Because this communication is so critical for an adversary, they often use techn | Name | Technique | Type | | ----------- | ----------- |--------------| -| [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | TTP | +| [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP | | [DNS Query Length Outliers - MLTK](/network/dns_query_length_outliers_-_mltk/) | [DNS](/tags/#dns) | Anomaly | | [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | Anomaly | | [Detect Large Outbound ICMP Packets](/network/detect_large_outbound_icmp_packets/) | [Non-Application Layer Protocol](/tags/#non-application-layer-protocol) | TTP | diff --git a/docs/_stories/container_implantation_monitoring_and_investigation.md b/docs/_stories/container_implantation_monitoring_and_investigation.md index 0e43a46e97..16eaac650e 100644 --- a/docs/_stories/container_implantation_monitoring_and_investigation.md +++ b/docs/_stories/container_implantation_monitoring_and_investigation.md @@ -2,6 +2,7 @@ title: "Container Implantation Monitoring and Investigation" last_modified_at: 2020-02-20 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/credential_dumping.md b/docs/_stories/credential_dumping.md index 62c5f51620..7fcfc99376 100644 --- a/docs/_stories/credential_dumping.md +++ b/docs/_stories/credential_dumping.md @@ -2,6 +2,7 @@ title: "Credential Dumping" last_modified_at: 2020-02-04 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -31,12 +32,12 @@ The detection searches in this Analytic Story monitor access to the Local Securi | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Access LSASS Memory for Dump Creation](/endpoint/access_lsass_memory_for_dump_creation/) | [LSASS Memory](/tags/#lsass-memory), [Process Injection](/tags/#process-injection), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Access Token Manipulation](/tags/#access-token-manipulation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Modify Authentication Process](/tags/#modify-authentication-process), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Account Discovery](/tags/#account-discovery), [Password Policy Discovery](/tags/#password-policy-discovery), [Unsecured Credentials](/tags/#unsecured-credentials), [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager), [NTDS](/tags/#ntds), [Kerberoasting](/tags/#kerberoasting), [PowerShell](/tags/#powershell) | TTP | +| [Access LSASS Memory for Dump Creation](/endpoint/access_lsass_memory_for_dump_creation/) | [LSASS Memory](/tags/#lsass-memory) | TTP | | [Applying Stolen Credentials via Mimikatz modules](/endpoint/applying_stolen_credentials_via_mimikatz_modules/) | [Process Injection](/tags/#process-injection), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Access Token Manipulation](/tags/#access-token-manipulation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Modify Authentication Process](/tags/#modify-authentication-process), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | TTP | | [Applying Stolen Credentials via PowerSploit modules](/endpoint/applying_stolen_credentials_via_powersploit_modules/) | [Process Injection](/tags/#process-injection), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Access Token Manipulation](/tags/#access-token-manipulation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | TTP | | [Assessment of Credential Strength via DSInternals modules](/endpoint/assessment_of_credential_strength_via_dsinternals_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Account Discovery](/tags/#account-discovery), [Password Policy Discovery](/tags/#password-policy-discovery), [Unsecured Credentials](/tags/#unsecured-credentials), [Credentials from Password Stores](/tags/#credentials-from-password-stores) | TTP | | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | -| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [CMSTP](/tags/#cmstp), [Process Injection](/tags/#process-injection), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [LSASS Memory](/tags/#lsass-memory), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Automated Exfiltration](/tags/#automated-exfiltration), [Service Execution](/tags/#service-execution), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | +| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager) | TTP | | [Create Remote Thread into LSASS](/endpoint/create_remote_thread_into_lsass/) | [LSASS Memory](/tags/#lsass-memory) | TTP | | [Creation of Shadow Copy](/endpoint/creation_of_shadow_copy/) | [NTDS](/tags/#ntds) | TTP | | [Creation of Shadow Copy with wmic and powershell](/endpoint/creation_of_shadow_copy_with_wmic_and_powershell/) | [NTDS](/tags/#ntds) | TTP | diff --git a/docs/_stories/darkside_ransomware.md b/docs/_stories/darkside_ransomware.md index 6071bee379..230791d807 100644 --- a/docs/_stories/darkside_ransomware.md +++ b/docs/_stories/darkside_ransomware.md @@ -2,6 +2,7 @@ title: "DarkSide Ransomware" last_modified_at: 2021-05-12 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -29,7 +30,7 @@ This story addresses Darkside ransomware. This ransomware payload has many simil | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [CMSTP](/tags/#cmstp), [Process Injection](/tags/#process-injection), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [LSASS Memory](/tags/#lsass-memory), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Automated Exfiltration](/tags/#automated-exfiltration), [Service Execution](/tags/#service-execution), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | +| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager) | TTP | | [BITSAdmin Download File](/endpoint/bitsadmin_download_file/) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | | [CMLUA Or CMSTPLUA UAC Bypass](/endpoint/cmlua_or_cmstplua_uac_bypass/) | [CMSTP](/tags/#cmstp) | TTP | | [CertUtil Download With URLCache and Split Arguments](/endpoint/certutil_download_with_urlcache_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | diff --git a/docs/_stories/data_exfiltration.md b/docs/_stories/data_exfiltration.md index b825e3bd86..3a55d9d6e4 100644 --- a/docs/_stories/data_exfiltration.md +++ b/docs/_stories/data_exfiltration.md @@ -2,6 +2,7 @@ title: "Data Exfiltration" last_modified_at: 2020-10-21 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -30,7 +31,7 @@ Exfiltration comes in many flavors. Adversaries can collect data over encrypted | Name | Technique | Type | | ----------- | ----------- |--------------| -| [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | TTP | +| [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP | | [Detect SNICat SNI Exfiltration](/network/detect_snicat_sni_exfiltration/) | [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel) | TTP | | [Detect shared ec2 snapshot](/cloud/detect_shared_ec2_snapshot/) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | TTP | | [Excessive Usage of NSLOOKUP App](/endpoint/excessive_usage_of_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly | diff --git a/docs/_stories/data_protection.md b/docs/_stories/data_protection.md index a72987f3b7..8287938a09 100644 --- a/docs/_stories/data_protection.md +++ b/docs/_stories/data_protection.md @@ -2,6 +2,7 @@ title: "Data Protection" last_modified_at: 2017-09-14 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/deobfuscate-decode_files_or_information.md b/docs/_stories/deobfuscate-decode_files_or_information.md index 9ba521764e..3a871d2797 100644 --- a/docs/_stories/deobfuscate-decode_files_or_information.md +++ b/docs/_stories/deobfuscate-decode_files_or_information.md @@ -2,6 +2,7 @@ title: "Deobfuscate-Decode Files or Information" last_modified_at: 2021-03-24 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/detect_zerologon_attack.md b/docs/_stories/detect_zerologon_attack.md index d9e0d12869..82dfa2f05f 100644 --- a/docs/_stories/detect_zerologon_attack.md +++ b/docs/_stories/detect_zerologon_attack.md @@ -2,6 +2,7 @@ title: "Detect Zerologon Attack" last_modified_at: 2020-09-18 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -28,7 +29,7 @@ This attack is a privilege escalation technique, where attacker targets a Netlog | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect Computer Changed with Anonymous Account](/endpoint/detect_computer_changed_with_anonymous_account/) | [Exploitation of Remote Services](/tags/#exploitation-of-remote-services), [LSASS Memory](/tags/#lsass-memory), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | Hunting | +| [Detect Computer Changed with Anonymous Account](/endpoint/detect_computer_changed_with_anonymous_account/) | [Exploitation of Remote Services](/tags/#exploitation-of-remote-services) | Hunting | | [Detect Credential Dumping through LSASS access](/endpoint/detect_credential_dumping_through_lsass_access/) | [LSASS Memory](/tags/#lsass-memory) | TTP | | [Detect Mimikatz Using Loaded Images](/endpoint/detect_mimikatz_using_loaded_images/) | [LSASS Memory](/tags/#lsass-memory) | TTP | | [Detect Zerologon via Zeek](/network/detect_zerologon_via_zeek/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | diff --git a/docs/_stories/dev_sec_ops.md b/docs/_stories/dev_sec_ops.md index 5075061972..dd55092a7b 100644 --- a/docs/_stories/dev_sec_ops.md +++ b/docs/_stories/dev_sec_ops.md @@ -2,6 +2,7 @@ title: "Dev Sec Ops" last_modified_at: 2021-08-18 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -29,7 +30,7 @@ DevSecOps is a collaborative framework, which thinks about application and infra | Name | Technique | Type | | ----------- | ----------- |--------------| -| [AWS ECR Container Scanning Findings High](/cloud/aws_ecr_container_scanning_findings_high/) | [Malicious Image](/tags/#malicious-image), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Exploitation for Credential Access](/tags/#exploitation-for-credential-access), [Cloud Service Discovery](/tags/#cloud-service-discovery) | TTP | +| [AWS ECR Container Scanning Findings High](/cloud/aws_ecr_container_scanning_findings_high/) | [Malicious Image](/tags/#malicious-image) | TTP | | [AWS ECR Container Scanning Findings Low Informational Unknown](/cloud/aws_ecr_container_scanning_findings_low_informational_unknown/) | [Malicious Image](/tags/#malicious-image) | Hunting | | [AWS ECR Container Scanning Findings Medium](/cloud/aws_ecr_container_scanning_findings_medium/) | [Malicious Image](/tags/#malicious-image) | Anomaly | | [AWS ECR Container Upload Outside Business Hours](/cloud/aws_ecr_container_upload_outside_business_hours/) | [Malicious Image](/tags/#malicious-image) | Anomaly | diff --git a/docs/_stories/dhs_report_ta18-074a.md b/docs/_stories/dhs_report_ta18-074a.md index 4d3211c4ea..be50653f90 100644 --- a/docs/_stories/dhs_report_ta18-074a.md +++ b/docs/_stories/dhs_report_ta18-074a.md @@ -2,6 +2,7 @@ title: "DHS Report TA18-074A" last_modified_at: 2020-01-22 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -33,7 +34,7 @@ Suspicious activities--spikes in SMB traffic, processes that launch netsh (to mo | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Create local admin accounts using net exe](/endpoint/create_local_admin_accounts_using_net_exe/) | [Local Account](/tags/#local-account), [File Transfer Protocols](/tags/#file-transfer-protocols), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [PowerShell](/tags/#powershell), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Windows Service](/tags/#windows-service), [Scheduled Task](/tags/#scheduled-task), [Malicious File](/tags/#malicious-file), [Modify Registry](/tags/#modify-registry) | TTP | +| [Create local admin accounts using net exe](/endpoint/create_local_admin_accounts_using_net_exe/) | [Local Account](/tags/#local-account) | TTP | | [Detect New Local Admin account](/endpoint/detect_new_local_admin_account/) | [Local Account](/tags/#local-account) | TTP | | [Detect Outbound SMB Traffic](/network/detect_outbound_smb_traffic/) | [File Transfer Protocols](/tags/#file-transfer-protocols) | TTP | | [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | diff --git a/docs/_stories/disabling_security_tools.md b/docs/_stories/disabling_security_tools.md index f87f6f3d35..5bb9d0a846 100644 --- a/docs/_stories/disabling_security_tools.md +++ b/docs/_stories/disabling_security_tools.md @@ -2,6 +2,7 @@ title: "Disabling Security Tools" last_modified_at: 2020-02-04 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -29,7 +30,7 @@ Attackers employ a variety of tactics in order to avoid detection and operate wi | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Attempt To Add Certificate To Untrusted Store](/endpoint/attempt_to_add_certificate_to_untrusted_store/) | [Install Root Certificate](/tags/#install-root-certificate), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Windows Service](/tags/#windows-service), [Modify Registry](/tags/#modify-registry) | TTP | +| [Attempt To Add Certificate To Untrusted Store](/endpoint/attempt_to_add_certificate_to_untrusted_store/) | [Install Root Certificate](/tags/#install-root-certificate) | TTP | | [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | | [Processes launching netsh](/endpoint/processes_launching_netsh/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall) | TTP | | [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service) | TTP | diff --git a/docs/_stories/dns_amplification_attacks.md b/docs/_stories/dns_amplification_attacks.md index e85c72b619..81bfca4696 100644 --- a/docs/_stories/dns_amplification_attacks.md +++ b/docs/_stories/dns_amplification_attacks.md @@ -2,6 +2,7 @@ title: "DNS Amplification Attacks" last_modified_at: 2016-09-13 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/dns_hijacking.md b/docs/_stories/dns_hijacking.md index c2886de5e1..3c1d540cdb 100644 --- a/docs/_stories/dns_hijacking.md +++ b/docs/_stories/dns_hijacking.md @@ -2,6 +2,7 @@ title: "DNS Hijacking" last_modified_at: 2020-02-04 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/domain_trust_discovery.md b/docs/_stories/domain_trust_discovery.md index b621d1e358..7228ec499b 100644 --- a/docs/_stories/domain_trust_discovery.md +++ b/docs/_stories/domain_trust_discovery.md @@ -2,6 +2,7 @@ title: "Domain Trust Discovery" last_modified_at: 2021-03-25 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -29,7 +30,7 @@ Domain trusts provide a mechanism for a domain to allow access to resources base | Name | Technique | Type | | ----------- | ----------- |--------------| -| [DSQuery Domain Discovery](/endpoint/dsquery_domain_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote System Discovery](/tags/#remote-system-discovery) | TTP | +| [DSQuery Domain Discovery](/endpoint/dsquery_domain_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | | [NLTest Domain Trust Discovery](/endpoint/nltest_domain_trust_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | | [Windows AdFind Exe](/endpoint/windows_adfind_exe/) | [Remote System Discovery](/tags/#remote-system-discovery) | TTP | diff --git a/docs/_stories/dynamic_dns.md b/docs/_stories/dynamic_dns.md index e27a003102..7b06511608 100644 --- a/docs/_stories/dynamic_dns.md +++ b/docs/_stories/dynamic_dns.md @@ -2,6 +2,7 @@ title: "Dynamic DNS" last_modified_at: 2018-09-06 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -30,7 +31,7 @@ Dynamic DNS services (DDNS) are legitimate low-cost or free services that allow | Name | Technique | Type | | ----------- | ----------- |--------------| -| [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | TTP | +| [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP | | [Detect hosts connecting to dynamic domain providers](/network/detect_hosts_connecting_to_dynamic_domain_providers/) | [Drive-by Compromise](/tags/#drive-by-compromise) | TTP | | [Excessive Usage of NSLOOKUP App](/endpoint/excessive_usage_of_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly | diff --git a/docs/_stories/emotet_malware__dhs_report_ta18-201a_.md b/docs/_stories/emotet_malware__dhs_report_ta18-201a_.md index 449cd469c6..f6a61bd541 100644 --- a/docs/_stories/emotet_malware__dhs_report_ta18-201a_.md +++ b/docs/_stories/emotet_malware__dhs_report_ta18-201a_.md @@ -2,6 +2,7 @@ title: "Emotet Malware DHS Report TA18-201A " last_modified_at: 2020-01-27 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -34,7 +35,7 @@ The searches in this Analytic Story will help you find executables that are rare | Name | Technique | Type | | ----------- | ----------- |--------------| | [Detect Rare Executables](/endpoint/detect_rare_executables/) | | Anomaly | -| [Detect Use of cmd exe to Launch Script Interpreters](/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters/) | [Windows Command Shell](/tags/#windows-command-shell), [Software Deployment Tools](/tags/#software-deployment-tools), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Detect Use of cmd exe to Launch Script Interpreters](/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters/) | [Windows Command Shell](/tags/#windows-command-shell) | TTP | | [Detection of tools built by NirSoft](/endpoint/detection_of_tools_built_by_nirsoft/) | [Software Deployment Tools](/tags/#software-deployment-tools) | TTP | | [Email Attachments With Lots Of Spaces](/application/email_attachments_with_lots_of_spaces/) | | Anomaly | | [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | TTP | diff --git a/docs/_stories/f5_tmui_rce_cve-2020-5902.md b/docs/_stories/f5_tmui_rce_cve-2020-5902.md index e0f6cbdf37..0ca1d44537 100644 --- a/docs/_stories/f5_tmui_rce_cve-2020-5902.md +++ b/docs/_stories/f5_tmui_rce_cve-2020-5902.md @@ -2,6 +2,7 @@ title: "F5 TMUI RCE CVE-2020-5902" last_modified_at: 2020-08-02 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/fin7.md b/docs/_stories/fin7.md index 5cd3f79f37..d73fff95c4 100644 --- a/docs/_stories/fin7.md +++ b/docs/_stories/fin7.md @@ -2,6 +2,7 @@ title: "FIN7" last_modified_at: 2021-09-14 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -29,7 +30,7 @@ FIN7 is a Russian criminal advanced persistent threat group that has primarily t | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Check Elevated CMD using whoami](/endpoint/check_elevated_cmd_using_whoami/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery), [JavaScript](/tags/#javascript), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Spearphishing Attachment](/tags/#spearphishing-attachment), [XSL Script Processing](/tags/#xsl-script-processing) | TTP | +| [Check Elevated CMD using whoami](/endpoint/check_elevated_cmd_using_whoami/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | TTP | | [Cmdline Tool Not Executed In CMD Shell](/endpoint/cmdline_tool_not_executed_in_cmd_shell/) | [JavaScript](/tags/#javascript) | TTP | | [Jscript Execution Using Cscript App](/endpoint/jscript_execution_using_cscript_app/) | [JavaScript](/tags/#javascript) | TTP | | [MS Scripting Process Loading Ldap Module](/endpoint/ms_scripting_process_loading_ldap_module/) | [JavaScript](/tags/#javascript) | Anomaly | diff --git a/docs/_stories/gcp_cross_account_activity.md b/docs/_stories/gcp_cross_account_activity.md index ba99219a20..bde070db0b 100644 --- a/docs/_stories/gcp_cross_account_activity.md +++ b/docs/_stories/gcp_cross_account_activity.md @@ -2,6 +2,7 @@ title: "GCP Cross Account Activity" last_modified_at: 2020-09-01 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/hafnium_group.md b/docs/_stories/hafnium_group.md index 180de98785..cf3bc9c9da 100644 --- a/docs/_stories/hafnium_group.md +++ b/docs/_stories/hafnium_group.md @@ -2,6 +2,7 @@ title: "HAFNIUM Group" last_modified_at: 2021-03-03 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -32,15 +33,15 @@ The following Splunk detections assist with identifying the HAFNIUM groups trade | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Any Powershell DownloadString](/endpoint/any_powershell_downloadstring/) | [PowerShell](/tags/#powershell), [Web Shell](/tags/#web-shell), [Local Account](/tags/#local-account), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [LSASS Memory](/tags/#lsass-memory), [Remote Email Collection](/tags/#remote-email-collection), [NTDS](/tags/#ntds), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | -| [Detect Exchange Web Shell](/endpoint/detect_exchange_web_shell/) | [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [PowerShell](/tags/#powershell) | TTP | +| [Any Powershell DownloadString](/endpoint/any_powershell_downloadstring/) | [PowerShell](/tags/#powershell) | TTP | +| [Detect Exchange Web Shell](/endpoint/detect_exchange_web_shell/) | [Web Shell](/tags/#web-shell) | TTP | | [Detect New Local Admin account](/endpoint/detect_new_local_admin_account/) | [Local Account](/tags/#local-account) | TTP | | [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | | [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [Service Execution](/tags/#service-execution) | Hunting | | [Dump LSASS via comsvcs DLL](/endpoint/dump_lsass_via_comsvcs_dll/) | [LSASS Memory](/tags/#lsass-memory) | TTP | | [Dump LSASS via procdump](/endpoint/dump_lsass_via_procdump/) | [LSASS Memory](/tags/#lsass-memory) | TTP | | [Email servers sending high volume traffic to hosts](/application/email_servers_sending_high_volume_traffic_to_hosts/) | [Remote Email Collection](/tags/#remote-email-collection) | Anomaly | -| [Malicious PowerShell Process - Connect To Internet With Hidden Window](/endpoint/malicious_powershell_process_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | TTP | +| [Malicious PowerShell Process - Connect To Internet With Hidden Window](/endpoint/malicious_powershell_process_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell) | Hunting | | [Malicious PowerShell Process - Execution Policy Bypass](/endpoint/malicious_powershell_process_-_execution_policy_bypass/) | [PowerShell](/tags/#powershell) | TTP | | [Nishang PowershellTCPOneLine](/endpoint/nishang_powershelltcponeline/) | [PowerShell](/tags/#powershell) | TTP | | [Ntdsutil Export NTDS](/endpoint/ntdsutil_export_ntds/) | [NTDS](/tags/#ntds) | TTP | diff --git a/docs/_stories/hidden_cobra_malware.md b/docs/_stories/hidden_cobra_malware.md index 8afc383318..1a7f8130ab 100644 --- a/docs/_stories/hidden_cobra_malware.md +++ b/docs/_stories/hidden_cobra_malware.md @@ -2,6 +2,7 @@ title: "Hidden Cobra Malware" last_modified_at: 2020-01-22 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -34,7 +35,7 @@ Among other searches in this Analytic Story is a detection search that looks for | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Create or delete windows shares using net exe](/endpoint/create_or_delete_windows_shares_using_net_exe/) | [Network Share Connection Removal](/tags/#network-share-connection-removal), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [File Transfer Protocols](/tags/#file-transfer-protocols), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | +| [Create or delete windows shares using net exe](/endpoint/create_or_delete_windows_shares_using_net_exe/) | [Network Share Connection Removal](/tags/#network-share-connection-removal) | TTP | | [DNS Query Length Outliers - MLTK](/network/dns_query_length_outliers_-_mltk/) | [DNS](/tags/#dns) | Anomaly | | [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | Anomaly | | [Detect Outbound SMB Traffic](/network/detect_outbound_smb_traffic/) | [File Transfer Protocols](/tags/#file-transfer-protocols) | TTP | diff --git a/docs/_stories/icedid.md b/docs/_stories/icedid.md index a626427f1f..6fb742cf7b 100644 --- a/docs/_stories/icedid.md +++ b/docs/_stories/icedid.md @@ -2,6 +2,7 @@ title: "IcedID" last_modified_at: 2021-07-29 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -29,7 +30,7 @@ IcedId banking trojan campaigns targeting banks and other vertical sectors.This | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Account Discovery With Net App](/endpoint/account_discovery_with_net_app/) | [Domain Account](/tags/#domain-account), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [Malicious File](/tags/#malicious-file), [Bypass User Account Control](/tags/#bypass-user-account-control), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Regsvr32](/tags/#regsvr32), [IP Addresses](/tags/#ip-addresses), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Scheduled Task](/tags/#scheduled-task), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | +| [Account Discovery With Net App](/endpoint/account_discovery_with_net_app/) | [Domain Account](/tags/#domain-account) | TTP | | [CHCP Command Execution](/endpoint/chcp_command_execution/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | | [Create Remote Thread In Shell Application](/endpoint/create_remote_thread_in_shell_application/) | [Process Injection](/tags/#process-injection) | TTP | | [Drop IcedID License dat](/endpoint/drop_icedid_license_dat/) | [Malicious File](/tags/#malicious-file) | Hunting | diff --git a/docs/_stories/ingress_tool_transfer.md b/docs/_stories/ingress_tool_transfer.md index 1fdf805947..2f10eee4b7 100644 --- a/docs/_stories/ingress_tool_transfer.md +++ b/docs/_stories/ingress_tool_transfer.md @@ -2,6 +2,7 @@ title: "Ingress Tool Transfer" last_modified_at: 2021-03-24 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -29,12 +30,12 @@ Ingress tool transfer is a Technique under tactic Command and Control. Behaviors | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Any Powershell DownloadFile](/endpoint/any_powershell_downloadfile/) | [PowerShell](/tags/#powershell), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [OS Credential Dumping](/tags/#os-credential-dumping), [Remote Services](/tags/#remote-services), [Screen Capture](/tags/#screen-capture), [Audio Capture](/tags/#audio-capture), [Remote Service Session Hijacking](/tags/#remote-service-session-hijacking), [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Impair Defenses](/tags/#impair-defenses) | TTP | -| [Any Powershell DownloadString](/endpoint/any_powershell_downloadstring/) | [PowerShell](/tags/#powershell), [Web Shell](/tags/#web-shell), [Local Account](/tags/#local-account), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [LSASS Memory](/tags/#lsass-memory), [Remote Email Collection](/tags/#remote-email-collection), [NTDS](/tags/#ntds), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | +| [Any Powershell DownloadFile](/endpoint/any_powershell_downloadfile/) | [PowerShell](/tags/#powershell) | TTP | +| [Any Powershell DownloadString](/endpoint/any_powershell_downloadstring/) | [PowerShell](/tags/#powershell) | TTP | | [BITSAdmin Download File](/endpoint/bitsadmin_download_file/) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | | [CertUtil Download With URLCache and Split Arguments](/endpoint/certutil_download_with_urlcache_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | | [CertUtil Download With VerifyCtl and Split Arguments](/endpoint/certutil_download_with_verifyctl_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | -| [Suspicious Curl Network Connection](/endpoint/suspicious_curl_network_connection/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Launch Agent](/tags/#launch-agent), [Data Staged](/tags/#data-staged) | TTP | +| [Suspicious Curl Network Connection](/endpoint/suspicious_curl_network_connection/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | #### Reference diff --git a/docs/_stories/jboss_vulnerability.md b/docs/_stories/jboss_vulnerability.md index f12f1ddb89..c415bc07b9 100644 --- a/docs/_stories/jboss_vulnerability.md +++ b/docs/_stories/jboss_vulnerability.md @@ -2,6 +2,7 @@ title: "JBoss Vulnerability" last_modified_at: 2017-09-14 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/kubernetes_scanning_activity.md b/docs/_stories/kubernetes_scanning_activity.md index 61205fcbe2..cf30698209 100644 --- a/docs/_stories/kubernetes_scanning_activity.md +++ b/docs/_stories/kubernetes_scanning_activity.md @@ -2,6 +2,7 @@ title: "Kubernetes Scanning Activity" last_modified_at: 2020-04-15 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/kubernetes_sensitive_object_access_activity.md b/docs/_stories/kubernetes_sensitive_object_access_activity.md index e80e9a13ef..035be27de1 100644 --- a/docs/_stories/kubernetes_sensitive_object_access_activity.md +++ b/docs/_stories/kubernetes_sensitive_object_access_activity.md @@ -2,6 +2,7 @@ title: "Kubernetes Sensitive Object Access Activity" last_modified_at: 2020-05-20 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/lateral_movement.md b/docs/_stories/lateral_movement.md index 1e54b9fada..f38f1ba842 100644 --- a/docs/_stories/lateral_movement.md +++ b/docs/_stories/lateral_movement.md @@ -2,6 +2,7 @@ title: "Lateral Movement" last_modified_at: 2020-02-04 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -34,7 +35,7 @@ If there is evidence of lateral movement, it is imperative for analysts to colle | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect Activity Related to Pass the Hash Attacks](/endpoint/detect_activity_related_to_pass_the_hash_attacks/) | [Pass the Hash](/tags/#pass-the-hash), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [Kerberoasting](/tags/#kerberoasting), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Scheduled Task](/tags/#scheduled-task) | TTP | +| [Detect Activity Related to Pass the Hash Attacks](/endpoint/detect_activity_related_to_pass_the_hash_attacks/) | [Pass the Hash](/tags/#pass-the-hash) | TTP | | [Detect Pass the Hash](/endpoint/detect_pass_the_hash/) | [Pass the Hash](/tags/#pass-the-hash) | TTP | | [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | | [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [Service Execution](/tags/#service-execution) | Hunting | diff --git a/docs/_stories/malicious_powershell.md b/docs/_stories/malicious_powershell.md index 93d74a4eec..be85b9e892 100644 --- a/docs/_stories/malicious_powershell.md +++ b/docs/_stories/malicious_powershell.md @@ -2,6 +2,7 @@ title: "Malicious PowerShell" last_modified_at: 2017-08-23 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -40,8 +41,8 @@ Most recently we have added new content related to PowerShell Script Block loggi | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Any Powershell DownloadFile](/endpoint/any_powershell_downloadfile/) | [PowerShell](/tags/#powershell), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [OS Credential Dumping](/tags/#os-credential-dumping), [Remote Services](/tags/#remote-services), [Screen Capture](/tags/#screen-capture), [Audio Capture](/tags/#audio-capture), [Remote Service Session Hijacking](/tags/#remote-service-session-hijacking), [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Impair Defenses](/tags/#impair-defenses) | TTP | -| [Any Powershell DownloadString](/endpoint/any_powershell_downloadstring/) | [PowerShell](/tags/#powershell), [Web Shell](/tags/#web-shell), [Local Account](/tags/#local-account), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [LSASS Memory](/tags/#lsass-memory), [Remote Email Collection](/tags/#remote-email-collection), [NTDS](/tags/#ntds), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | +| [Any Powershell DownloadFile](/endpoint/any_powershell_downloadfile/) | [PowerShell](/tags/#powershell) | TTP | +| [Any Powershell DownloadString](/endpoint/any_powershell_downloadstring/) | [PowerShell](/tags/#powershell) | TTP | | [Credential Extraction indicative of use of DSInternals credential conversion modules](/endpoint/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Credential Extraction indicative of use of DSInternals modules](/endpoint/credential_extraction_indicative_of_use_of_dsinternals_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Credential Extraction indicative of use of PowerSploit modules](/endpoint/credential_extraction_indicative_of_use_of_powersploit_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | @@ -51,7 +52,7 @@ Most recently we have added new content related to PowerShell Script Block loggi | [Illegal Access To User Content via PowerSploit modules](/endpoint/illegal_access_to_user_content_via_powersploit_modules/) | [Remote Services](/tags/#remote-services), [Screen Capture](/tags/#screen-capture), [Audio Capture](/tags/#audio-capture), [Remote Service Session Hijacking](/tags/#remote-service-session-hijacking) | TTP | | [Illegal Privilege Elevation and Persistence via PowerSploit modules](/endpoint/illegal_privilege_elevation_and_persistence_via_powersploit_modules/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | | [Illegal Service and Process Control via PowerSploit modules](/endpoint/illegal_service_and_process_control_via_powersploit_modules/) | [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services) | TTP | -| [Malicious PowerShell Process - Connect To Internet With Hidden Window](/endpoint/malicious_powershell_process_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | TTP | +| [Malicious PowerShell Process - Connect To Internet With Hidden Window](/endpoint/malicious_powershell_process_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell) | Hunting | | [Malicious PowerShell Process - Encoded Command](/endpoint/malicious_powershell_process_-_encoded_command/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information) | Hunting | | [Malicious PowerShell Process With Obfuscation Techniques](/endpoint/malicious_powershell_process_with_obfuscation_techniques/) | [PowerShell](/tags/#powershell) | TTP | | [PowerShell 4104 Hunting](/endpoint/powershell_4104_hunting/) | [PowerShell](/tags/#powershell) | Hunting | diff --git a/docs/_stories/masquerading_-_rename_system_utilities.md b/docs/_stories/masquerading_-_rename_system_utilities.md index 0944fcdf57..e0c606ef45 100644 --- a/docs/_stories/masquerading_-_rename_system_utilities.md +++ b/docs/_stories/masquerading_-_rename_system_utilities.md @@ -2,6 +2,7 @@ title: "Masquerading - Rename System Utilities" last_modified_at: 2021-04-26 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -31,7 +32,7 @@ There will be false positives as some native Windows processes are moved or ran | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Execution of File with Multiple Extensions](/endpoint/execution_of_file_with_multiple_extensions/) | [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [Rundll32](/tags/#rundll32), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Masquerading](/tags/#masquerading) | TTP | +| [Execution of File with Multiple Extensions](/endpoint/execution_of_file_with_multiple_extensions/) | [Rename System Utilities](/tags/#rename-system-utilities) | TTP | | [Suspicious MSBuild Rename](/endpoint/suspicious_msbuild_rename/) | [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities) | TTP | | [Suspicious Rundll32 Rename](/endpoint/suspicious_rundll32_rename/) | [Rundll32](/tags/#rundll32), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | | [Suspicious microsoft workflow compiler rename](/endpoint/suspicious_microsoft_workflow_compiler_rename/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | diff --git a/docs/_stories/meterpreter.md b/docs/_stories/meterpreter.md index 23824d67e6..9b6a871cee 100644 --- a/docs/_stories/meterpreter.md +++ b/docs/_stories/meterpreter.md @@ -2,6 +2,7 @@ title: "Meterpreter" last_modified_at: 2021-06-08 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -31,6 +32,7 @@ While investigating a detection related to this analytic story, please bear in m | Name | Technique | Type | | ----------- | ----------- |--------------| +| [Excessive number of distinct processes created in Windows Temp folder](/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | Anomaly | | [Excessive number of taskhost processes](/endpoint/excessive_number_of_taskhost_processes/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Anomaly | #### Reference diff --git a/docs/_stories/microsoft_mshtml_remote_code_execution_cve-2021-40444.md b/docs/_stories/microsoft_mshtml_remote_code_execution_cve-2021-40444.md index 3cdaa5beb8..690f586cf2 100644 --- a/docs/_stories/microsoft_mshtml_remote_code_execution_cve-2021-40444.md +++ b/docs/_stories/microsoft_mshtml_remote_code_execution_cve-2021-40444.md @@ -2,6 +2,7 @@ title: "Microsoft MSHTML Remote Code Execution CVE-2021-40444" last_modified_at: 2021-09-08 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -31,7 +32,7 @@ Microsoft is aware of targeted attacks that attempt to exploit this vulnerabilit | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Control Loading from World Writable Directory](/endpoint/control_loading_from_world_writable_directory/) | [Control Panel](/tags/#control-panel), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Rundll32](/tags/#rundll32) | TTP | +| [Control Loading from World Writable Directory](/endpoint/control_loading_from_world_writable_directory/) | [Control Panel](/tags/#control-panel) | TTP | | [MSHTML Module Load in Office Product](/endpoint/mshtml_module_load_in_office_product/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | | [Office Product Writing cab or inf](/endpoint/office_product_writing_cab_or_inf/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | | [Office Spawning Control](/endpoint/office_spawning_control/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | diff --git a/docs/_stories/monitor_for_updates.md b/docs/_stories/monitor_for_updates.md index 2b7289fdcc..19dd3c6a63 100644 --- a/docs/_stories/monitor_for_updates.md +++ b/docs/_stories/monitor_for_updates.md @@ -2,6 +2,7 @@ title: "Monitor for Updates" last_modified_at: 2017-09-15 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/netsh_abuse.md b/docs/_stories/netsh_abuse.md index 2be2da0db7..fc4228b9c5 100644 --- a/docs/_stories/netsh_abuse.md +++ b/docs/_stories/netsh_abuse.md @@ -2,6 +2,7 @@ title: "Netsh Abuse" last_modified_at: 2017-01-05 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/nobelium_group.md b/docs/_stories/nobelium_group.md index f267c4ebc5..bce9583086 100644 --- a/docs/_stories/nobelium_group.md +++ b/docs/_stories/nobelium_group.md @@ -2,6 +2,7 @@ title: "NOBELIUM Group" last_modified_at: 2020-12-14 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -31,11 +32,11 @@ This Analytic Story supports you to detect Tactics, Techniques and Procedures (T | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Anomalous usage of 7zip](/endpoint/anomalous_usage_of_7zip/) | [Archive via Utility](/tags/#archive-via-utility), [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service), [Process Injection](/tags/#process-injection), [File Transfer Protocols](/tags/#file-transfer-protocols), [Regsvr32](/tags/#regsvr32), [Mshta](/tags/#mshta), [Service Execution](/tags/#service-execution), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Rundll32](/tags/#rundll32), [Scheduled Task](/tags/#scheduled-task), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Web Shell](/tags/#web-shell), [MSBuild](/tags/#msbuild), [Rename System Utilities](/tags/#rename-system-utilities), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Web Protocols](/tags/#web-protocols), [Remote System Discovery](/tags/#remote-system-discovery) | Anomaly | +| [Anomalous usage of 7zip](/endpoint/anomalous_usage_of_7zip/) | [Archive via Utility](/tags/#archive-via-utility) | Anomaly | | [Detect Outbound SMB Traffic](/network/detect_outbound_smb_traffic/) | [File Transfer Protocols](/tags/#file-transfer-protocols) | TTP | -| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | +| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Windows Command Shell](/tags/#windows-command-shell) | Hunting | | [Detect Rundll32 Inline HTA Execution](/endpoint/detect_rundll32_inline_hta_execution/) | [Mshta](/tags/#mshta) | TTP | -| [First Time Seen Running Windows Service](/endpoint/first_time_seen_running_windows_service/) | [Service Execution](/tags/#service-execution), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Windows Service](/tags/#windows-service) | Anomaly | +| [First Time Seen Running Windows Service](/endpoint/first_time_seen_running_windows_service/) | [Service Execution](/tags/#service-execution) | Anomaly | | [Malicious PowerShell Process - Encoded Command](/endpoint/malicious_powershell_process_-_encoded_command/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information) | Hunting | | [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service) | TTP | | [Scheduled Task Deleted Or Created via CMD](/endpoint/scheduled_task_deleted_or_created_via_cmd/) | [Scheduled Task](/tags/#scheduled-task) | TTP | diff --git a/docs/_stories/office_365_detections.md b/docs/_stories/office_365_detections.md index 9cb6bf0241..ffbbb892c1 100644 --- a/docs/_stories/office_365_detections.md +++ b/docs/_stories/office_365_detections.md @@ -2,6 +2,7 @@ title: "Office 365 Detections" last_modified_at: 2020-12-16 toc: true +toc_label: "" tags: - Splunk Security Analytics for AWS - Splunk Enterprise @@ -29,7 +30,7 @@ More and more companies are using Microsofts Office 365 cloud offering. Therefor | Name | Technique | Type | | ----------- | ----------- |--------------| -| [High Number of Login Failures from a single source](/cloud/high_number_of_login_failures_from_a_single_source/) | [Password Guessing](/tags/#password-guessing), [Cloud Account](/tags/#cloud-account), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Modify Authentication Process](/tags/#modify-authentication-process), [Brute Force](/tags/#brute-force), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Remote Email Collection](/tags/#remote-email-collection) | Anomaly | +| [High Number of Login Failures from a single source](/cloud/high_number_of_login_failures_from_a_single_source/) | [Password Guessing](/tags/#password-guessing) | Anomaly | | [O365 Add App Role Assignment Grant User](/cloud/o365_add_app_role_assignment_grant_user/) | [Cloud Account](/tags/#cloud-account) | TTP | | [O365 Added Service Principal](/cloud/o365_added_service_principal/) | [Cloud Account](/tags/#cloud-account) | TTP | | [O365 Bypass MFA via Trusted IP](/cloud/o365_bypass_mfa_via_trusted_ip/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | TTP | diff --git a/docs/_stories/orangeworm_attack_group.md b/docs/_stories/orangeworm_attack_group.md index a6d05e9c21..e231aa5f2d 100644 --- a/docs/_stories/orangeworm_attack_group.md +++ b/docs/_stories/orangeworm_attack_group.md @@ -2,6 +2,7 @@ title: "Orangeworm Attack Group" last_modified_at: 2020-01-22 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -32,7 +33,7 @@ This Analytic Story is designed to help you detect and investigate suspicious ac | Name | Technique | Type | | ----------- | ----------- |--------------| -| [First Time Seen Running Windows Service](/endpoint/first_time_seen_running_windows_service/) | [Service Execution](/tags/#service-execution), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Windows Service](/tags/#windows-service) | Anomaly | +| [First Time Seen Running Windows Service](/endpoint/first_time_seen_running_windows_service/) | [Service Execution](/tags/#service-execution) | Anomaly | | [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service) | TTP | #### Reference diff --git a/docs/_stories/petitpotam_ntlm_relay_on_active_directory_certificate_services.md b/docs/_stories/petitpotam_ntlm_relay_on_active_directory_certificate_services.md index 34c25d337f..a7117627d6 100644 --- a/docs/_stories/petitpotam_ntlm_relay_on_active_directory_certificate_services.md +++ b/docs/_stories/petitpotam_ntlm_relay_on_active_directory_certificate_services.md @@ -2,6 +2,7 @@ title: "PetitPotam NTLM Relay on Active Directory Certificate Services" last_modified_at: 2021-08-31 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -28,7 +29,7 @@ In June 2021, security researchers at SpecterOps released a blog post and white | Name | Technique | Type | | ----------- | ----------- |--------------| -| [PetitPotam Network Share Access Request](/endpoint/petitpotam_network_share_access_request/) | [Forced Authentication](/tags/#forced-authentication), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | +| [PetitPotam Network Share Access Request](/endpoint/petitpotam_network_share_access_request/) | [Forced Authentication](/tags/#forced-authentication) | TTP | | [PetitPotam Suspicious Kerberos TGT Request](/endpoint/petitpotam_suspicious_kerberos_tgt_request/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | #### Reference diff --git a/docs/_stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.md b/docs/_stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.md index 75040494e8..aa1c32cb06 100644 --- a/docs/_stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.md +++ b/docs/_stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.md @@ -2,6 +2,7 @@ title: "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns" last_modified_at: 2020-01-22 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -56,7 +57,7 @@ If behavioral searches included in this story yield positive hits, iDefense reco | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Malicious PowerShell Process - Connect To Internet With Hidden Window](/endpoint/malicious_powershell_process_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | TTP | +| [Malicious PowerShell Process - Connect To Internet With Hidden Window](/endpoint/malicious_powershell_process_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell) | Hunting | | [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | TTP | | [Unusually Long Command Line](/endpoint/unusually_long_command_line/) | | Anomaly | | [Unusually Long Command Line - MLTK](/endpoint/unusually_long_command_line_-_mltk/) | | Anomaly | diff --git a/docs/_stories/printnightmare_cve-2021-34527.md b/docs/_stories/printnightmare_cve-2021-34527.md index eb3d925b86..bf16400e8c 100644 --- a/docs/_stories/printnightmare_cve-2021-34527.md +++ b/docs/_stories/printnightmare_cve-2021-34527.md @@ -2,6 +2,7 @@ title: "PrintNightmare CVE-2021-34527" last_modified_at: 2021-07-01 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -34,7 +35,7 @@ In the most impactful scenario, an attacker would be able to leverage this vulne | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Print Spooler Adding A Printer Driver](/endpoint/print_spooler_adding_a_printer_driver/) | [Print Processors](/tags/#print-processors), [Rundll32](/tags/#rundll32), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | TTP | +| [Print Spooler Adding A Printer Driver](/endpoint/print_spooler_adding_a_printer_driver/) | [Print Processors](/tags/#print-processors) | TTP | | [Print Spooler Failed to Load a Plug-in](/endpoint/print_spooler_failed_to_load_a_plug-in/) | [Print Processors](/tags/#print-processors) | TTP | | [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [Rundll32](/tags/#rundll32) | TTP | | [Spoolsv Spawning Rundll32](/endpoint/spoolsv_spawning_rundll32/) | [Print Processors](/tags/#print-processors) | TTP | diff --git a/docs/_stories/prohibited_traffic_allowed_or_protocol_mismatch.md b/docs/_stories/prohibited_traffic_allowed_or_protocol_mismatch.md index 1e3923b79d..661f68cdf9 100644 --- a/docs/_stories/prohibited_traffic_allowed_or_protocol_mismatch.md +++ b/docs/_stories/prohibited_traffic_allowed_or_protocol_mismatch.md @@ -2,6 +2,7 @@ title: "Prohibited Traffic Allowed or Protocol Mismatch" last_modified_at: 2017-09-11 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -31,7 +32,7 @@ A traditional security best practice is to control the ports, protocols, and ser | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Allow Inbound Traffic By Firewall Rule Registry](/endpoint/allow_inbound_traffic_by_firewall_rule_registry/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Drive-by Compromise](/tags/#drive-by-compromise), [Remote Services](/tags/#remote-services), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Web Protocols](/tags/#web-protocols) | TTP | +| [Allow Inbound Traffic By Firewall Rule Registry](/endpoint/allow_inbound_traffic_by_firewall_rule_registry/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | TTP | | [Allow Inbound Traffic In Firewall Rule](/endpoint/allow_inbound_traffic_in_firewall_rule/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol) | TTP | | [Detect hosts connecting to dynamic domain providers](/network/detect_hosts_connecting_to_dynamic_domain_providers/) | [Drive-by Compromise](/tags/#drive-by-compromise) | TTP | | [Enable RDP In Other Port Number](/endpoint/enable_rdp_in_other_port_number/) | [Remote Services](/tags/#remote-services) | TTP | diff --git a/docs/_stories/proxyshell.md b/docs/_stories/proxyshell.md index 15b18b9d74..d6e0914329 100644 --- a/docs/_stories/proxyshell.md +++ b/docs/_stories/proxyshell.md @@ -2,6 +2,7 @@ title: "ProxyShell" last_modified_at: 2021-08-24 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -33,7 +34,7 @@ Upon successful exploitation, the remote attacker will have `SYSTEM` privileges | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect Exchange Web Shell](/endpoint/detect_exchange_web_shell/) | [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [PowerShell](/tags/#powershell) | TTP | +| [Detect Exchange Web Shell](/endpoint/detect_exchange_web_shell/) | [Web Shell](/tags/#web-shell) | TTP | | [Exchange PowerShell Abuse via SSRF](/endpoint/exchange_powershell_abuse_via_ssrf/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | | [Exchange PowerShell Module Usage](/endpoint/exchange_powershell_module_usage/) | [PowerShell](/tags/#powershell) | TTP | | [W3WP Spawning Shell](/endpoint/w3wp_spawning_shell/) | [Web Shell](/tags/#web-shell) | TTP | diff --git a/docs/_stories/ransomware.md b/docs/_stories/ransomware.md index 46c8ebb948..e5f56c6f11 100644 --- a/docs/_stories/ransomware.md +++ b/docs/_stories/ransomware.md @@ -2,6 +2,7 @@ title: "Ransomware" last_modified_at: 2020-02-04 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -30,13 +31,13 @@ Ransomware is an ever-present risk to the enterprise, wherein an infected host e | Name | Technique | Type | | ----------- | ----------- |--------------| -| [7zip CommandLine To SMB Share Path](/endpoint/7zip_commandline_to_smb_share_path/) | [Archive via Utility](/tags/#archive-via-utility), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Service Stop](/tags/#service-stop), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [CMSTP](/tags/#cmstp), [File Deletion](/tags/#file-deletion), [Data Destruction](/tags/#data-destruction), [User Execution](/tags/#user-execution), [Automated Exfiltration](/tags/#automated-exfiltration), [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Account Access Removal](/tags/#account-access-removal), [Service Execution](/tags/#service-execution), [Visual Basic](/tags/#visual-basic), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Modify Registry](/tags/#modify-registry), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Scheduled Task](/tags/#scheduled-task), [Rename System Utilities](/tags/#rename-system-utilities), [Web Protocols](/tags/#web-protocols), [Msiexec](/tags/#msiexec) | Hunting | +| [7zip CommandLine To SMB Share Path](/endpoint/7zip_commandline_to_smb_share_path/) | [Archive via Utility](/tags/#archive-via-utility) | Hunting | | [Allow File And Printing Sharing In Firewall](/endpoint/allow_file_and_printing_sharing_in_firewall/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | TTP | -| [Allow Network Discovery In Firewall](/endpoint/allow_network_discovery_in_firewall/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [User Execution](/tags/#user-execution), [Modify Registry](/tags/#modify-registry), [CMSTP](/tags/#cmstp) | TTP | +| [Allow Network Discovery In Firewall](/endpoint/allow_network_discovery_in_firewall/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | TTP | | [Allow Operation with Consent Admin](/endpoint/allow_operation_with_consent_admin/) | [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | | [Attempt To Disable Services](/endpoint/attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | TTP | | [Attempt To delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop) | TTP | -| [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Data Destruction](/tags/#data-destruction), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Command Shell](/tags/#windows-command-shell), [Scheduled Task](/tags/#scheduled-task), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Service Stop](/tags/#service-stop) | TTP | +| [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [CMLUA Or CMSTPLUA UAC Bypass](/endpoint/cmlua_or_cmstplua_uac_bypass/) | [CMSTP](/tags/#cmstp) | TTP | | [Clear Unallocated Sector Using Cipher App](/endpoint/clear_unallocated_sector_using_cipher_app/) | [File Deletion](/tags/#file-deletion) | TTP | | [Common Ransomware Extensions](/endpoint/common_ransomware_extensions/) | [Data Destruction](/tags/#data-destruction) | Hunting | @@ -44,7 +45,7 @@ Ransomware is an ever-present risk to the enterprise, wherein an infected host e | [Conti Common Exec parameter](/endpoint/conti_common_exec_parameter/) | [User Execution](/tags/#user-execution) | TTP | | [Delete A Net User](/endpoint/delete_a_net_user/) | [Service Stop](/tags/#service-stop) | Anomaly | | [Delete ShadowCopy With PowerShell](/endpoint/delete_shadowcopy_with_powershell/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | -| [Deleting Shadow Copies](/endpoint/deleting_shadow_copies/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Deleting Shadow Copies](/endpoint/deleting_shadow_copies/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [Detect RClone Command-Line Usage](/endpoint/detect_rclone_command-line_usage/) | [Automated Exfiltration](/tags/#automated-exfiltration) | TTP | | [Detect Renamed RClone](/endpoint/detect_renamed_rclone/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Hunting | | [Detect SharpHound Command-Line Arguments](/endpoint/detect_sharphound_command-line_arguments/) | [Domain Account](/tags/#domain-account), [Local Account](/tags/#local-account), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Domain Groups](/tags/#domain-groups), [Local Groups](/tags/#local-groups) | TTP | diff --git a/docs/_stories/ransomware_cloud.md b/docs/_stories/ransomware_cloud.md index 83a87669cc..77b557ccd2 100644 --- a/docs/_stories/ransomware_cloud.md +++ b/docs/_stories/ransomware_cloud.md @@ -2,6 +2,7 @@ title: "Ransomware Cloud" last_modified_at: 2020-10-27 toc: true +toc_label: "" tags: - Splunk Security Analytics for AWS - Splunk Enterprise diff --git a/docs/_stories/remcos.md b/docs/_stories/remcos.md index e5fb2bf776..508bfb87f9 100644 --- a/docs/_stories/remcos.md +++ b/docs/_stories/remcos.md @@ -2,6 +2,7 @@ title: "Remcos" last_modified_at: 2021-09-23 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -29,11 +30,12 @@ Remcos or Remote Control and Surveillance, marketed as a legitimate software for | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Masquerading](/tags/#masquerading), [Port Monitors](/tags/#port-monitors), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Application Shimming](/tags/#application-shimming), [Screen Capture](/tags/#screen-capture), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | +| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | | [Executables Or Script Creation In Suspicious Path](/endpoint/executables_or_script_creation_in_suspicious_path/) | [Masquerading](/tags/#masquerading) | TTP | | [Process Deleting Its Process File Path](/endpoint/process_deleting_its_process_file_path/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | | [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | TTP | | [Remcos RAT File Creation in Remcos Folder](/endpoint/remcos_rat_file_creation_in_remcos_folder/) | [Screen Capture](/tags/#screen-capture) | TTP | +| [Remcos client registry install entry](/endpoint/remcos_client_registry_install_entry/) | [Modify Registry](/tags/#modify-registry) | TTP | | [Suspicious Image Creation In Appdata Folder](/endpoint/suspicious_image_creation_in_appdata_folder/) | [Screen Capture](/tags/#screen-capture) | TTP | | [Suspicious Process File Path](/endpoint/suspicious_process_file_path/) | [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | | [Suspicious WAV file in Appdata Folder](/endpoint/suspicious_wav_file_in_appdata_folder/) | [Screen Capture](/tags/#screen-capture) | TTP | diff --git a/docs/_stories/revil_ransomware.md b/docs/_stories/revil_ransomware.md index 75688b6650..04684d21d3 100644 --- a/docs/_stories/revil_ransomware.md +++ b/docs/_stories/revil_ransomware.md @@ -2,6 +2,7 @@ title: "Revil Ransomware" last_modified_at: 2021-06-04 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -29,7 +30,7 @@ Revil ransomware is a RaaS,that a single group may operates and manges the devel | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Allow Network Discovery In Firewall](/endpoint/allow_network_discovery_in_firewall/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [User Execution](/tags/#user-execution), [Modify Registry](/tags/#modify-registry), [CMSTP](/tags/#cmstp) | TTP | +| [Allow Network Discovery In Firewall](/endpoint/allow_network_discovery_in_firewall/) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall) | TTP | | [Delete ShadowCopy With PowerShell](/endpoint/delete_shadowcopy_with_powershell/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [Disable Windows Behavior Monitoring](/endpoint/disable_windows_behavior_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | | [Modification Of Wallpaper](/endpoint/modification_of_wallpaper/) | [Defacement](/tags/#defacement) | TTP | diff --git a/docs/_stories/router_and_infrastructure_security.md b/docs/_stories/router_and_infrastructure_security.md index 9df60813e7..d31565bc42 100644 --- a/docs/_stories/router_and_infrastructure_security.md +++ b/docs/_stories/router_and_infrastructure_security.md @@ -2,6 +2,7 @@ title: "Router and Infrastructure Security" last_modified_at: 2017-09-12 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -31,7 +32,7 @@ This Analytic Story helps you gain a better understanding of how your network de | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect ARP Poisoning](/network/detect_arp_poisoning/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [ARP Cache Poisoning](/tags/#arp-cache-poisoning), [Man-in-the-Middle](/tags/#man-in-the-middle), [TFTP Boot](/tags/#tftp-boot), [Traffic Duplication](/tags/#traffic-duplication) | TTP | +| [Detect ARP Poisoning](/network/detect_arp_poisoning/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | | [Detect IPv6 Network Infrastructure Threats](/network/detect_ipv6_network_infrastructure_threats/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | | [Detect New Login Attempts to Routers](/application/detect_new_login_attempts_to_routers/) | | TTP | | [Detect Port Security Violation](/network/detect_port_security_violation/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP | diff --git a/docs/_stories/ryuk_ransomware.md b/docs/_stories/ryuk_ransomware.md index 61f8c86c21..0e3e682295 100644 --- a/docs/_stories/ryuk_ransomware.md +++ b/docs/_stories/ryuk_ransomware.md @@ -2,6 +2,7 @@ title: "Ryuk Ransomware" last_modified_at: 2020-11-06 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -30,7 +31,7 @@ Cybersecurity Infrastructure Security Agency (CISA) released Alert (AA20-302A) o | Name | Technique | Type | | ----------- | ----------- |--------------| -| [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Data Destruction](/tags/#data-destruction), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Command Shell](/tags/#windows-command-shell), [Scheduled Task](/tags/#scheduled-task), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Service Stop](/tags/#service-stop) | TTP | +| [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [Common Ransomware Extensions](/endpoint/common_ransomware_extensions/) | [Data Destruction](/tags/#data-destruction) | Hunting | | [Common Ransomware Notes](/endpoint/common_ransomware_notes/) | [Data Destruction](/tags/#data-destruction) | Hunting | | [NLTest Domain Trust Discovery](/endpoint/nltest_domain_trust_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP | diff --git a/docs/_stories/samsam_ransomware.md b/docs/_stories/samsam_ransomware.md index 0da62894a1..ee80e1cccb 100644 --- a/docs/_stories/samsam_ransomware.md +++ b/docs/_stories/samsam_ransomware.md @@ -2,6 +2,7 @@ title: "SamSam Ransomware" last_modified_at: 2018-12-13 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -36,11 +37,11 @@ This Analytic Story includes searches designed to help detect and investigate si | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Attacker Tools On Endpoint](/endpoint/attacker_tools_on_endpoint/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping), [Service Stop](/tags/#service-stop), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Account Access Removal](/tags/#account-access-removal), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Software Deployment Tools](/tags/#software-deployment-tools), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Rundll32](/tags/#rundll32), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | +| [Attacker Tools On Endpoint](/endpoint/attacker_tools_on_endpoint/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Batch File Write to System32](/endpoint/batch_file_write_to_system32/) | [Malicious File](/tags/#malicious-file) | TTP | | [Common Ransomware Extensions](/endpoint/common_ransomware_extensions/) | [Data Destruction](/tags/#data-destruction) | Hunting | | [Common Ransomware Notes](/endpoint/common_ransomware_notes/) | [Data Destruction](/tags/#data-destruction) | Hunting | -| [Deleting Shadow Copies](/endpoint/deleting_shadow_copies/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Deleting Shadow Copies](/endpoint/deleting_shadow_copies/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | | [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [Service Execution](/tags/#service-execution) | Hunting | | [Detect attackers scanning for vulnerable JBoss servers](/web/detect_attackers_scanning_for_vulnerable_jboss_servers/) | [System Information Discovery](/tags/#system-information-discovery) | TTP | diff --git a/docs/_stories/silver_sparrow.md b/docs/_stories/silver_sparrow.md index ee0b5cdced..a916b4ee1e 100644 --- a/docs/_stories/silver_sparrow.md +++ b/docs/_stories/silver_sparrow.md @@ -2,6 +2,7 @@ title: "Silver Sparrow" last_modified_at: 2021-02-24 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -29,7 +30,7 @@ Silver Sparrow works is a dropper and uses typical persistence mechanisms on a M | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Suspicious Curl Network Connection](/endpoint/suspicious_curl_network_connection/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Launch Agent](/tags/#launch-agent), [Data Staged](/tags/#data-staged) | TTP | +| [Suspicious Curl Network Connection](/endpoint/suspicious_curl_network_connection/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | | [Suspicious PlistBuddy Usage](/endpoint/suspicious_plistbuddy_usage/) | [Launch Agent](/tags/#launch-agent) | TTP | | [Suspicious PlistBuddy Usage via OSquery](/endpoint/suspicious_plistbuddy_usage_via_osquery/) | [Launch Agent](/tags/#launch-agent) | TTP | | [Suspicious SQLite3 LSQuarantine Behavior](/endpoint/suspicious_sqlite3_lsquarantine_behavior/) | [Data Staged](/tags/#data-staged) | TTP | diff --git a/docs/_stories/spearphishing_attachments.md b/docs/_stories/spearphishing_attachments.md index 0f7fa10f8e..b1fbcd12f4 100644 --- a/docs/_stories/spearphishing_attachments.md +++ b/docs/_stories/spearphishing_attachments.md @@ -2,6 +2,7 @@ title: "Spearphishing Attachments" last_modified_at: 2019-04-29 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -36,7 +37,7 @@ This Analytic Story focuses on detecting signs that a malicious payload has been | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect Outlook exe writing a zip file](/endpoint/detect_outlook_exe_writing_a_zip_file/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Security Account Manager](/tags/#security-account-manager), [Spearphishing Link](/tags/#spearphishing-link) | TTP | +| [Detect Outlook exe writing a zip file](/endpoint/detect_outlook_exe_writing_a_zip_file/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | | [Excel Spawning PowerShell](/endpoint/excel_spawning_powershell/) | [Security Account Manager](/tags/#security-account-manager) | TTP | | [Excel Spawning Windows Script Host](/endpoint/excel_spawning_windows_script_host/) | [Security Account Manager](/tags/#security-account-manager) | TTP | | [MSHTML Module Load in Office Product](/endpoint/mshtml_module_load_in_office_product/) | [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | diff --git a/docs/_stories/sql_injection.md b/docs/_stories/sql_injection.md index 3117134c77..982468d504 100644 --- a/docs/_stories/sql_injection.md +++ b/docs/_stories/sql_injection.md @@ -2,6 +2,7 @@ title: "SQL Injection" last_modified_at: 2017-09-19 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/suspicious_aws_login_activities.md b/docs/_stories/suspicious_aws_login_activities.md index a8b4a322ce..291786683c 100644 --- a/docs/_stories/suspicious_aws_login_activities.md +++ b/docs/_stories/suspicious_aws_login_activities.md @@ -2,6 +2,7 @@ title: "Suspicious AWS Login Activities" last_modified_at: 2019-05-01 toc: true +toc_label: "" tags: - Splunk Security Analytics for AWS - Splunk Enterprise diff --git a/docs/_stories/suspicious_aws_s3_activities.md b/docs/_stories/suspicious_aws_s3_activities.md index 06dfce975d..76df396542 100644 --- a/docs/_stories/suspicious_aws_s3_activities.md +++ b/docs/_stories/suspicious_aws_s3_activities.md @@ -2,6 +2,7 @@ title: "Suspicious AWS S3 Activities" last_modified_at: 2018-07-24 toc: true +toc_label: "" tags: - Splunk Security Analytics for AWS - Splunk Enterprise diff --git a/docs/_stories/suspicious_aws_traffic.md b/docs/_stories/suspicious_aws_traffic.md index 2e7680486b..f537c45ed3 100644 --- a/docs/_stories/suspicious_aws_traffic.md +++ b/docs/_stories/suspicious_aws_traffic.md @@ -2,6 +2,7 @@ title: "Suspicious AWS Traffic" last_modified_at: 2018-05-07 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/suspicious_cloud_authentication_activities.md b/docs/_stories/suspicious_cloud_authentication_activities.md index 917db70e8f..69458c9bfe 100644 --- a/docs/_stories/suspicious_cloud_authentication_activities.md +++ b/docs/_stories/suspicious_cloud_authentication_activities.md @@ -2,6 +2,7 @@ title: "Suspicious Cloud Authentication Activities" last_modified_at: 2020-06-04 toc: true +toc_label: "" tags: - Splunk Security Analytics for AWS - Splunk Enterprise diff --git a/docs/_stories/suspicious_cloud_instance_activities.md b/docs/_stories/suspicious_cloud_instance_activities.md index 39a61a4076..0eb6f09476 100644 --- a/docs/_stories/suspicious_cloud_instance_activities.md +++ b/docs/_stories/suspicious_cloud_instance_activities.md @@ -2,6 +2,7 @@ title: "Suspicious Cloud Instance Activities" last_modified_at: 2020-08-25 toc: true +toc_label: "" tags: - Splunk Security Analytics for AWS - Splunk Enterprise @@ -30,8 +31,8 @@ Monitoring your cloud infrastructure logs allows you enable governance, complian | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Abnormally High Number Of Cloud Instances Destroyed](/cloud/abnormally_high_number_of_cloud_instances_destroyed/) | [Cloud Accounts](/tags/#cloud-accounts), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | Anomaly | -| [Abnormally High Number Of Cloud Instances Launched](/cloud/abnormally_high_number_of_cloud_instances_launched/) | [Cloud Accounts](/tags/#cloud-accounts), [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | Anomaly | +| [Abnormally High Number Of Cloud Instances Destroyed](/cloud/abnormally_high_number_of_cloud_instances_destroyed/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | +| [Abnormally High Number Of Cloud Instances Launched](/cloud/abnormally_high_number_of_cloud_instances_launched/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | | [Cloud Instance Modified By Previously Unseen User](/cloud/cloud_instance_modified_by_previously_unseen_user/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | | [Detect shared ec2 snapshot](/cloud/detect_shared_ec2_snapshot/) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | TTP | diff --git a/docs/_stories/suspicious_cloud_provisioning_activities.md b/docs/_stories/suspicious_cloud_provisioning_activities.md index 84f03b685f..044d70cd9f 100644 --- a/docs/_stories/suspicious_cloud_provisioning_activities.md +++ b/docs/_stories/suspicious_cloud_provisioning_activities.md @@ -2,6 +2,7 @@ title: "Suspicious Cloud Provisioning Activities" last_modified_at: 2018-08-20 toc: true +toc_label: "" tags: - Splunk Security Analytics for AWS - Splunk Enterprise diff --git a/docs/_stories/suspicious_cloud_user_activities.md b/docs/_stories/suspicious_cloud_user_activities.md index 44aa32fff3..bff4078331 100644 --- a/docs/_stories/suspicious_cloud_user_activities.md +++ b/docs/_stories/suspicious_cloud_user_activities.md @@ -2,6 +2,7 @@ title: "Suspicious Cloud User Activities" last_modified_at: 2020-09-04 toc: true +toc_label: "" tags: - Splunk Security Analytics for AWS - Splunk Enterprise @@ -31,7 +32,7 @@ In addition to compromising the security of your data, when bad actors leverage | Name | Technique | Type | | ----------- | ----------- |--------------| -| [AWS IAM AccessDenied Discovery Events](/cloud/aws_iam_accessdenied_discovery_events/) | [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts) | Anomaly | +| [AWS IAM AccessDenied Discovery Events](/cloud/aws_iam_accessdenied_discovery_events/) | [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery) | Anomaly | | [Abnormally High Number Of Cloud Infrastructure API Calls](/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | | [Abnormally High Number Of Cloud Security Group API Calls](/cloud/abnormally_high_number_of_cloud_security_group_api_calls/) | [Cloud Accounts](/tags/#cloud-accounts) | Anomaly | | [Cloud API Calls From Previously Unseen User Roles](/cloud/cloud_api_calls_from_previously_unseen_user_roles/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly | diff --git a/docs/_stories/suspicious_command-line_executions.md b/docs/_stories/suspicious_command-line_executions.md index 7ad08d3a9b..db10ec080f 100644 --- a/docs/_stories/suspicious_command-line_executions.md +++ b/docs/_stories/suspicious_command-line_executions.md @@ -2,6 +2,7 @@ title: "Suspicious Command-Line Executions" last_modified_at: 2020-02-03 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -29,9 +30,9 @@ The ability to execute arbitrary commands via the Windows CLI is a primary goal | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | +| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Windows Command Shell](/tags/#windows-command-shell) | Hunting | | [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | -| [Detect Use of cmd exe to Launch Script Interpreters](/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters/) | [Windows Command Shell](/tags/#windows-command-shell), [Software Deployment Tools](/tags/#software-deployment-tools), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | +| [Detect Use of cmd exe to Launch Script Interpreters](/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters/) | [Windows Command Shell](/tags/#windows-command-shell) | TTP | | [System Processes Run From Unexpected Locations](/endpoint/system_processes_run_from_unexpected_locations/) | [Rename System Utilities](/tags/#rename-system-utilities) | TTP | | [Unusually Long Command Line](/endpoint/unusually_long_command_line/) | | Anomaly | | [Unusually Long Command Line - MLTK](/endpoint/unusually_long_command_line_-_mltk/) | | Anomaly | diff --git a/docs/_stories/suspicious_compiled_html_activity.md b/docs/_stories/suspicious_compiled_html_activity.md index 9aaad35e4d..73dfaaa5af 100644 --- a/docs/_stories/suspicious_compiled_html_activity.md +++ b/docs/_stories/suspicious_compiled_html_activity.md @@ -2,6 +2,7 @@ title: "Suspicious Compiled HTML Activity" last_modified_at: 2021-02-11 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/suspicious_dns_traffic.md b/docs/_stories/suspicious_dns_traffic.md index 98a7f6a040..4cc8a34e6b 100644 --- a/docs/_stories/suspicious_dns_traffic.md +++ b/docs/_stories/suspicious_dns_traffic.md @@ -2,6 +2,7 @@ title: "Suspicious DNS Traffic" last_modified_at: 2017-09-18 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -30,7 +31,7 @@ Although DNS is one of the fundamental underlying protocols that make the Intern | Name | Technique | Type | | ----------- | ----------- |--------------| -| [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [DNS](/tags/#dns), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Drive-by Compromise](/tags/#drive-by-compromise), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Local Email Collection](/tags/#local-email-collection), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Web Protocols](/tags/#web-protocols) | TTP | +| [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP | | [DNS Query Length Outliers - MLTK](/network/dns_query_length_outliers_-_mltk/) | [DNS](/tags/#dns) | Anomaly | | [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | Anomaly | | [Detect hosts connecting to dynamic domain providers](/network/detect_hosts_connecting_to_dynamic_domain_providers/) | [Drive-by Compromise](/tags/#drive-by-compromise) | TTP | diff --git a/docs/_stories/suspicious_emails.md b/docs/_stories/suspicious_emails.md index 8c2ebcfe4c..4e900e0c29 100644 --- a/docs/_stories/suspicious_emails.md +++ b/docs/_stories/suspicious_emails.md @@ -2,6 +2,7 @@ title: "Suspicious Emails" last_modified_at: 2020-01-27 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/suspicious_gcp_storage_activities.md b/docs/_stories/suspicious_gcp_storage_activities.md index 1d6e2fc3a4..812d32fc9c 100644 --- a/docs/_stories/suspicious_gcp_storage_activities.md +++ b/docs/_stories/suspicious_gcp_storage_activities.md @@ -2,6 +2,7 @@ title: "Suspicious GCP Storage Activities" last_modified_at: 2020-08-05 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/suspicious_mshta_activity.md b/docs/_stories/suspicious_mshta_activity.md index 8cf1c5b96a..e88c3176f4 100644 --- a/docs/_stories/suspicious_mshta_activity.md +++ b/docs/_stories/suspicious_mshta_activity.md @@ -2,6 +2,7 @@ title: "Suspicious MSHTA Activity" last_modified_at: 2021-01-20 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -41,8 +42,8 @@ The objective of this step is to confirm the executed script code is benign or m | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [Mshta](/tags/#mshta), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | TTP | -| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | +| [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [Mshta](/tags/#mshta) | TTP | +| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Windows Command Shell](/tags/#windows-command-shell) | Hunting | | [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | | [Detect Rundll32 Inline HTA Execution](/endpoint/detect_rundll32_inline_hta_execution/) | [Mshta](/tags/#mshta) | TTP | | [Detect mshta inline hta execution](/endpoint/detect_mshta_inline_hta_execution/) | [Mshta](/tags/#mshta) | TTP | diff --git a/docs/_stories/suspicious_okta_activity.md b/docs/_stories/suspicious_okta_activity.md index 8e8c7782e1..86d5fe9ddf 100644 --- a/docs/_stories/suspicious_okta_activity.md +++ b/docs/_stories/suspicious_okta_activity.md @@ -2,6 +2,7 @@ title: "Suspicious Okta Activity" last_modified_at: 2020-04-02 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/suspicious_regsvcs_regasm_activity.md b/docs/_stories/suspicious_regsvcs_regasm_activity.md index 5e96d31952..ed0850cb23 100644 --- a/docs/_stories/suspicious_regsvcs_regasm_activity.md +++ b/docs/_stories/suspicious_regsvcs_regasm_activity.md @@ -2,6 +2,7 @@ title: "Suspicious Regsvcs Regasm Activity" last_modified_at: 2021-02-11 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/suspicious_regsvr32_activity.md b/docs/_stories/suspicious_regsvr32_activity.md index 70327fc619..468b57b910 100644 --- a/docs/_stories/suspicious_regsvr32_activity.md +++ b/docs/_stories/suspicious_regsvr32_activity.md @@ -2,6 +2,7 @@ title: "Suspicious Regsvr32 Activity" last_modified_at: 2021-01-29 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/suspicious_rundll32_activity.md b/docs/_stories/suspicious_rundll32_activity.md index de719a930c..719980c449 100644 --- a/docs/_stories/suspicious_rundll32_activity.md +++ b/docs/_stories/suspicious_rundll32_activity.md @@ -2,6 +2,7 @@ title: "Suspicious Rundll32 Activity" last_modified_at: 2021-02-03 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -29,7 +30,7 @@ One common adversary tactic is to bypass application control solutions via the r | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect Rundll32 Application Control Bypass - advpack](/endpoint/detect_rundll32_application_control_bypass_-_advpack/) | [Rundll32](/tags/#rundll32), [LSASS Memory](/tags/#lsass-memory), [Rename System Utilities](/tags/#rename-system-utilities) | TTP | +| [Detect Rundll32 Application Control Bypass - advpack](/endpoint/detect_rundll32_application_control_bypass_-_advpack/) | [Rundll32](/tags/#rundll32) | TTP | | [Detect Rundll32 Application Control Bypass - setupapi](/endpoint/detect_rundll32_application_control_bypass_-_setupapi/) | [Rundll32](/tags/#rundll32) | TTP | | [Detect Rundll32 Application Control Bypass - syssetup](/endpoint/detect_rundll32_application_control_bypass_-_syssetup/) | [Rundll32](/tags/#rundll32) | TTP | | [Dump LSASS via comsvcs DLL](/endpoint/dump_lsass_via_comsvcs_dll/) | [LSASS Memory](/tags/#lsass-memory) | TTP | diff --git a/docs/_stories/suspicious_windows_registry_activities.md b/docs/_stories/suspicious_windows_registry_activities.md index 6b18930ccb..d5bb596658 100644 --- a/docs/_stories/suspicious_windows_registry_activities.md +++ b/docs/_stories/suspicious_windows_registry_activities.md @@ -2,6 +2,7 @@ title: "Suspicious Windows Registry Activities" last_modified_at: 2018-05-31 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -31,7 +32,7 @@ Attackers are developing increasingly sophisticated techniques for hijacking tar | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Masquerading](/tags/#masquerading), [Port Monitors](/tags/#port-monitors), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Application Shimming](/tags/#application-shimming), [Screen Capture](/tags/#screen-capture), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | +| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | | [Monitor Registry Keys for Print Monitors](/endpoint/monitor_registry_keys_for_print_monitors/) | [Port Monitors](/tags/#port-monitors) | TTP | | [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder) | TTP | | [Registry Keys Used For Privilege Escalation](/endpoint/registry_keys_used_for_privilege_escalation/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | TTP | diff --git a/docs/_stories/suspicious_wmi_use.md b/docs/_stories/suspicious_wmi_use.md index 51bb31bf36..051927f838 100644 --- a/docs/_stories/suspicious_wmi_use.md +++ b/docs/_stories/suspicious_wmi_use.md @@ -2,6 +2,7 @@ title: "Suspicious WMI Use" last_modified_at: 2018-10-23 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -29,7 +30,7 @@ WMI is a Microsoft infrastructure for management data and operations on Windows | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect WMI Event Subscription Persistence](/endpoint/detect_wmi_event_subscription_persistence/) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription), [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP | +| [Detect WMI Event Subscription Persistence](/endpoint/detect_wmi_event_subscription_persistence/) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription) | TTP | | [Process Execution via WMI](/endpoint/process_execution_via_wmi/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP | | [Remote Process Instantiation via WMI](/endpoint/remote_process_instantiation_via_wmi/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP | | [Remote WMI Command Attempt](/endpoint/remote_wmi_command_attempt/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP | diff --git a/docs/_stories/suspicious_zoom_child_processes.md b/docs/_stories/suspicious_zoom_child_processes.md index 6f9d274c48..f57871c652 100644 --- a/docs/_stories/suspicious_zoom_child_processes.md +++ b/docs/_stories/suspicious_zoom_child_processes.md @@ -2,6 +2,7 @@ title: "Suspicious Zoom Child Processes" last_modified_at: 2020-04-13 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -30,7 +31,7 @@ Current detections focus on finding new child processes of this application on a | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting | +| [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Windows Command Shell](/tags/#windows-command-shell) | Hunting | | [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | | [First Time Seen Child Process of Zoom](/endpoint/first_time_seen_child_process_of_zoom/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | Anomaly | diff --git a/docs/_stories/trickbot.md b/docs/_stories/trickbot.md index 76b118f8ed..fc9312172c 100644 --- a/docs/_stories/trickbot.md +++ b/docs/_stories/trickbot.md @@ -2,6 +2,7 @@ title: "Trickbot" last_modified_at: 2021-04-20 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -29,7 +30,7 @@ trickbot banking trojan campaigns targeting banks and other vertical sectors.Thi | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Account Discovery With Net App](/endpoint/account_discovery_with_net_app/) | [Domain Account](/tags/#domain-account), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [Malicious File](/tags/#malicious-file), [Bypass User Account Control](/tags/#bypass-user-account-control), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Regsvr32](/tags/#regsvr32), [IP Addresses](/tags/#ip-addresses), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Scheduled Task](/tags/#scheduled-task), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP | +| [Account Discovery With Net App](/endpoint/account_discovery_with_net_app/) | [Domain Account](/tags/#domain-account) | TTP | | [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | | [Cobalt Strike Named Pipes](/endpoint/cobalt_strike_named_pipes/) | [Process Injection](/tags/#process-injection) | TTP | | [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [Mshta](/tags/#mshta) | TTP | diff --git a/docs/_stories/trusted_developer_utilities_proxy_execution.md b/docs/_stories/trusted_developer_utilities_proxy_execution.md index ded55e4cda..927fb15e23 100644 --- a/docs/_stories/trusted_developer_utilities_proxy_execution.md +++ b/docs/_stories/trusted_developer_utilities_proxy_execution.md @@ -2,6 +2,7 @@ title: "Trusted Developer Utilities Proxy Execution" last_modified_at: 2021-01-12 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/trusted_developer_utilities_proxy_execution_msbuild.md b/docs/_stories/trusted_developer_utilities_proxy_execution_msbuild.md index 3bc0ff508d..30cc38c193 100644 --- a/docs/_stories/trusted_developer_utilities_proxy_execution_msbuild.md +++ b/docs/_stories/trusted_developer_utilities_proxy_execution_msbuild.md @@ -2,6 +2,7 @@ title: "Trusted Developer Utilities Proxy Execution MSBuild" last_modified_at: 2021-01-21 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/unusual_processes.md b/docs/_stories/unusual_processes.md index 9bd71ffafe..359310e8cd 100644 --- a/docs/_stories/unusual_processes.md +++ b/docs/_stories/unusual_processes.md @@ -2,6 +2,7 @@ title: "Unusual Processes" last_modified_at: 2020-02-04 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -31,7 +32,7 @@ In the event an unusual process is identified, it is imperative to better unders | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Attacker Tools On Endpoint](/endpoint/attacker_tools_on_endpoint/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping), [Service Stop](/tags/#service-stop), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Account Access Removal](/tags/#account-access-removal), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Software Deployment Tools](/tags/#software-deployment-tools), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Rundll32](/tags/#rundll32), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | +| [Attacker Tools On Endpoint](/endpoint/attacker_tools_on_endpoint/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Credential Extraction indicative of FGDump and CacheDump with s option](/endpoint/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Credential Extraction indicative of FGDump and CacheDump with v option](/endpoint/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Credential Extraction indicative of use of Mimikatz modules](/endpoint/credential_extraction_indicative_of_use_of_mimikatz_modules/) | [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | diff --git a/docs/_stories/use_of_cleartext_protocols.md b/docs/_stories/use_of_cleartext_protocols.md index 26cd4eb3e8..91b23da4d7 100644 --- a/docs/_stories/use_of_cleartext_protocols.md +++ b/docs/_stories/use_of_cleartext_protocols.md @@ -2,6 +2,7 @@ title: "Use of Cleartext Protocols" last_modified_at: 2017-09-15 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/windows_defense_evasion_tactics.md b/docs/_stories/windows_defense_evasion_tactics.md index dbc8a82df1..9054a39c77 100644 --- a/docs/_stories/windows_defense_evasion_tactics.md +++ b/docs/_stories/windows_defense_evasion_tactics.md @@ -2,6 +2,7 @@ title: "Windows Defense Evasion Tactics" last_modified_at: 2018-05-31 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -29,7 +30,7 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Disable Registry Tool](/endpoint/disable_registry_tool/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Bypass User Account Control](/tags/#bypass-user-account-control), [Modify Registry](/tags/#modify-registry), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Masquerading](/tags/#masquerading) | TTP | +| [Disable Registry Tool](/endpoint/disable_registry_tool/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | | [Disable Show Hidden Files](/endpoint/disable_show_hidden_files/) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | | [Disable Windows Behavior Monitoring](/endpoint/disable_windows_behavior_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | | [Disable Windows SmartScreen Protection](/endpoint/disable_windows_smartscreen_protection/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | @@ -38,7 +39,7 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve | [Disabling Firewall with Netsh](/endpoint/disabling_firewall_with_netsh/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | | [Disabling FolderOptions Windows Feature](/endpoint/disabling_folderoptions_windows_feature/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | | [Disabling NoRun Windows App](/endpoint/disabling_norun_windows_app/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | -| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Masquerading](/tags/#masquerading), [Port Monitors](/tags/#port-monitors), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Application Shimming](/tags/#application-shimming), [Screen Capture](/tags/#screen-capture), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | +| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | | [Disabling SystemRestore In Registry](/endpoint/disabling_systemrestore_in_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | | [Disabling Task Manager](/endpoint/disabling_task_manager/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | TTP | | [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control) | TTP | diff --git a/docs/_stories/windows_discovery_techniques.md b/docs/_stories/windows_discovery_techniques.md index dec3afece2..cf75442434 100644 --- a/docs/_stories/windows_discovery_techniques.md +++ b/docs/_stories/windows_discovery_techniques.md @@ -2,6 +2,7 @@ title: "Windows Discovery Techniques" last_modified_at: 2021-03-04 toc: true +toc_label: "" tags: - Splunk Behavioral Analytics - Splunk Enterprise @@ -29,7 +30,7 @@ Attackers may not have much if any insight into their target's environment befor | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules](/endpoint/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Discovery](/tags/#account-discovery), [Domain Policy Modification](/tags/#domain-policy-modification), [Trusted Relationship](/tags/#trusted-relationship), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Gather Victim Org Information](/tags/#gather-victim-org-information), [Active Scanning](/tags/#active-scanning), [Gather Victim Host Information](/tags/#gather-victim-host-information), [System Service Discovery](/tags/#system-service-discovery), [Query Registry](/tags/#query-registry), [Network Service Scanning](/tags/#network-service-scanning), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Discovery](/tags/#process-discovery), [File and Directory Discovery](/tags/#file-and-directory-discovery), [Software Discovery](/tags/#software-discovery), [Software](/tags/#software), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Network Share Discovery](/tags/#network-share-discovery), [Data from Network Shared Drive](/tags/#data-from-network-shared-drive), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Credentials](/tags/#credentials), [Domain Properties](/tags/#domain-properties), [Network Trust Dependencies](/tags/#network-trust-dependencies), [Account Manipulation](/tags/#account-manipulation), [Vulnerability Scanning](/tags/#vulnerability-scanning), [Process Injection](/tags/#process-injection) | TTP | +| [Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules](/endpoint/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Discovery](/tags/#account-discovery), [Domain Policy Modification](/tags/#domain-policy-modification) | TTP | | [Reconnaissance and Access to Accounts and Groups via Mimikatz modules](/endpoint/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Discovery](/tags/#account-discovery), [Domain Policy Modification](/tags/#domain-policy-modification) | TTP | | [Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit modules](/endpoint/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules/) | [Trusted Relationship](/tags/#trusted-relationship), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Gather Victim Org Information](/tags/#gather-victim-org-information), [Active Scanning](/tags/#active-scanning) | TTP | | [Reconnaissance and Access to Computers and Domains via PowerSploit modules](/endpoint/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules/) | [Gather Victim Host Information](/tags/#gather-victim-host-information), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Account Discovery](/tags/#account-discovery) | TTP | diff --git a/docs/_stories/windows_dns_sigred_cve-2020-1350.md b/docs/_stories/windows_dns_sigred_cve-2020-1350.md index aae0ff98bf..93ab8b3240 100644 --- a/docs/_stories/windows_dns_sigred_cve-2020-1350.md +++ b/docs/_stories/windows_dns_sigred_cve-2020-1350.md @@ -2,6 +2,7 @@ title: "Windows DNS SIGRed CVE-2020-1350" last_modified_at: 2020-07-28 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security diff --git a/docs/_stories/windows_file_extension_and_association_abuse.md b/docs/_stories/windows_file_extension_and_association_abuse.md index 9b5a33e7fb..7182428ee0 100644 --- a/docs/_stories/windows_file_extension_and_association_abuse.md +++ b/docs/_stories/windows_file_extension_and_association_abuse.md @@ -2,6 +2,7 @@ title: "Windows File Extension and Association Abuse" last_modified_at: 2018-01-26 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -33,7 +34,7 @@ Run the searches in this story to detect and investigate suspicious behavior tha | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Execution of File with Multiple Extensions](/endpoint/execution_of_file_with_multiple_extensions/) | [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [Rundll32](/tags/#rundll32), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Masquerading](/tags/#masquerading) | TTP | +| [Execution of File with Multiple Extensions](/endpoint/execution_of_file_with_multiple_extensions/) | [Rename System Utilities](/tags/#rename-system-utilities) | TTP | #### Reference diff --git a/docs/_stories/windows_log_manipulation.md b/docs/_stories/windows_log_manipulation.md index df6015a0c7..3730051e98 100644 --- a/docs/_stories/windows_log_manipulation.md +++ b/docs/_stories/windows_log_manipulation.md @@ -2,6 +2,7 @@ title: "Windows Log Manipulation" last_modified_at: 2017-09-12 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -30,7 +31,7 @@ The Analytic Story gives users two different ways to detect manipulation of Wind | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Deleting Shadow Copies](/endpoint/deleting_shadow_copies/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | +| [Deleting Shadow Copies](/endpoint/deleting_shadow_copies/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP | | [Illegal Deletion of Logs via Mimikatz modules](/endpoint/illegal_deletion_of_logs_via_mimikatz_modules/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP | | [Suspicious Event Log Service Behavior](/endpoint/suspicious_event_log_service_behavior/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | | [Suspicious wevtutil Usage](/endpoint/suspicious_wevtutil_usage/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | diff --git a/docs/_stories/windows_persistence_techniques.md b/docs/_stories/windows_persistence_techniques.md index 1237c58a0c..f83b173379 100644 --- a/docs/_stories/windows_persistence_techniques.md +++ b/docs/_stories/windows_persistence_techniques.md @@ -2,6 +2,7 @@ title: "Windows Persistence Techniques" last_modified_at: 2018-05-31 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -30,7 +31,7 @@ Maintaining persistence is one of the first steps taken by attackers after the i | Name | Technique | Type | | ----------- | ----------- |--------------| | [Certutil exe certificate extraction](/endpoint/certutil_exe_certificate_extraction/) | | TTP | -| [Detect Path Interception By Creation Of program exe](/endpoint/detect_path_interception_by_creation_of_program_exe/) | [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Establish Accounts](/tags/#establish-accounts), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Rogue Domain Controller](/tags/#rogue-domain-controller), [Domain Policy Modification](/tags/#domain-policy-modification), [Scheduled Task/Job](/tags/#scheduled-task/job), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Port Monitors](/tags/#port-monitors), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Application Shimming](/tags/#application-shimming), [Windows Service](/tags/#windows-service), [Scheduled Task](/tags/#scheduled-task), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | TTP | +| [Detect Path Interception By Creation Of program exe](/endpoint/detect_path_interception_by_creation_of_program_exe/) | [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path) | TTP | | [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification) | TTP | | [Illegal Account Creation via PowerSploit modules](/endpoint/illegal_account_creation_via_powersploit_modules/) | [Establish Accounts](/tags/#establish-accounts) | TTP | | [Illegal Enabling or Disabling of Accounts via DSInternals modules](/endpoint/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP | diff --git a/docs/_stories/windows_privilege_escalation.md b/docs/_stories/windows_privilege_escalation.md index 58746fc065..5f3c6562bd 100644 --- a/docs/_stories/windows_privilege_escalation.md +++ b/docs/_stories/windows_privilege_escalation.md @@ -2,6 +2,7 @@ title: "Windows Privilege Escalation" last_modified_at: 2020-02-04 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -29,7 +30,7 @@ Privilege escalation is a "land-and-expand" technique, wherein an adversary gain | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Child Processes of Spoolsv exe](/endpoint/child_processes_of_spoolsv_exe/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Accessibility Features](/tags/#accessibility-features), [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection) | TTP | +| [Child Processes of Spoolsv exe](/endpoint/child_processes_of_spoolsv_exe/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | TTP | | [Illegal Privilege Elevation via Mimikatz modules](/endpoint/illegal_privilege_elevation_via_mimikatz_modules/) | [Access Token Manipulation](/tags/#access-token-manipulation), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP | | [Overwriting Accessibility Binaries](/endpoint/overwriting_accessibility_binaries/) | [Accessibility Features](/tags/#accessibility-features) | TTP | | [Probing Access with Stolen Credentials via PowerSploit modules](/endpoint/probing_access_with_stolen_credentials_via_powersploit_modules/) | [Valid Accounts](/tags/#valid-accounts), [Account Manipulation](/tags/#account-manipulation) | TTP | diff --git a/docs/_stories/windows_service_abuse.md b/docs/_stories/windows_service_abuse.md index 8b153fbaed..cb0820168a 100644 --- a/docs/_stories/windows_service_abuse.md +++ b/docs/_stories/windows_service_abuse.md @@ -2,6 +2,7 @@ title: "Windows Service Abuse" last_modified_at: 2017-11-02 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -29,7 +30,7 @@ The Windows operating system uses a services architecture to allow for running c | Name | Technique | Type | | ----------- | ----------- |--------------| -| [First Time Seen Running Windows Service](/endpoint/first_time_seen_running_windows_service/) | [Service Execution](/tags/#service-execution), [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Windows Service](/tags/#windows-service) | Anomaly | +| [First Time Seen Running Windows Service](/endpoint/first_time_seen_running_windows_service/) | [Service Execution](/tags/#service-execution) | Anomaly | | [Illegal Service and Process Control via Mimikatz modules](/endpoint/illegal_service_and_process_control_via_mimikatz_modules/) | [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services) | TTP | | [Illegal Service and Process Control via PowerSploit modules](/endpoint/illegal_service_and_process_control_via_powersploit_modules/) | [Process Injection](/tags/#process-injection), [Native API](/tags/#native-api), [System Services](/tags/#system-services) | TTP | | [Reg exe Manipulating Windows Services Registry Keys](/endpoint/reg_exe_manipulating_windows_services_registry_keys/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | TTP | diff --git a/docs/_stories/xmrig.md b/docs/_stories/xmrig.md index 003bc0d741..0791d66d3e 100644 --- a/docs/_stories/xmrig.md +++ b/docs/_stories/xmrig.md @@ -2,6 +2,7 @@ title: "XMRig" last_modified_at: 2021-05-07 toc: true +toc_label: "" tags: - Splunk Enterprise - Splunk Enterprise Security @@ -29,7 +30,7 @@ XMRig is a high performance, open source, cross platform RandomX, KawPow, Crypto | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Attacker Tools On Endpoint](/endpoint/attacker_tools_on_endpoint/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping), [Service Stop](/tags/#service-stop), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Account Access Removal](/tags/#account-access-removal), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Service Execution](/tags/#service-execution), [System Information Discovery](/tags/#system-information-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Regsvr32](/tags/#regsvr32), [Indirect Command Execution](/tags/#indirect-command-execution), [Scheduled Task/Job](/tags/#scheduled-task/job), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [Software Deployment Tools](/tags/#software-deployment-tools), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Rundll32](/tags/#rundll32), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | +| [Attacker Tools On Endpoint](/endpoint/attacker_tools_on_endpoint/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Active Scanning](/tags/#active-scanning), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP | | [Attempt To Disable Services](/endpoint/attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | TTP | | [Attempt To delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop) | TTP | | [Delete A Net User](/endpoint/delete_a_net_user/) | [Service Stop](/tags/#service-stop) | Anomaly | diff --git a/docs/detections.wiki b/docs/detections.wiki index a7b6d3a139..8dad067eaf 100644 --- a/docs/detections.wiki +++ b/docs/detections.wiki @@ -16389,12 +16389,12 @@ It is possible that a legitimate user is experiencing an issue causing multiple ---- ===Detect exchange web shell=== -The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. +The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint * '''ATT&CK''': [https://attack.mitre.org/techniques/T1505/003/ T1505.003] -* '''Last Updated''': 2021-03-09 +* '''Last Updated''': 2021-10-05
@@ -16475,7 +16475,7 @@ The query is structured in a way that `action` (read, create) is not defined. Re * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log -''version'': 2 +''version'': 3
@@ -24504,7 +24504,7 @@ This analytic will identify suspicious series of process executions. We have ob ====Associated Analytic Story==== -* [[Documentation:ESSOC:stories:UseCase#meterpreter|meterpreter]] +* [[Documentation:ESSOC:stories:UseCase#Meterpreter|Meterpreter]] ====How To Implement==== @@ -31555,22 +31555,27 @@ unknown ---- ===Malicious powershell process - connect to internet with hidden window=== -This search looks for PowerShell processes started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet. This combination of command-line options is suspicious because it's overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet. Deprecated becaue hidden is not needed when download file with System.Net.WebClient. +The following hunting analytic identifies PowerShell commands utilizing the WindowStyle parameter to hide the window on the compromised endpoint. This combination of command-line options is suspicious because it is overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet. Removed in this version of the query is New-Object. The analytic identifies all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter. For example w, win, windowsty and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint * '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/001/ T1059.001] -* '''Last Updated''': 2020-11-20 +* '''Last Updated''': 2021-10-05
====Search==== -| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*-WindowStyle* Processes.process=*hidden* Processes.process="*New-Object*" by Processes.user Processes.process_name Processes.original_file_name Processes.parent_process_name Processes.process Processes.dest +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` +| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +| where match(process,"(?i)[\- +|\/ +|– +|— +|―]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]") | `malicious_powershell_process___connect_to_internet_with_hidden_window_filter` ====Associated Analytic Story==== @@ -31583,33 +31588,21 @@ This search looks for PowerShell processes started with parameters to modify the ====How To Implement==== -To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. ====Required field==== * _time -* Processes.dest +* Processes.process + +* Processes.process_name * Processes.user * Processes.parent_process_name -* Processes.parent_process - -* Processes.original_file_name - -* Processes.process_name - -* Processes.process - -* Processes.process_id - -* Processes.parent_process_path - -* Processes.process_path - -* Processes.parent_process_id +* Processes.dest @@ -31638,34 +31631,52 @@ Legitimate process can have this combination of command-line options, but it' ====Reference==== +* https://regexr.com/663rr + +* https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1 + +* https://ss64.com/ps/powershell.html + +* https://twitter.com/M_haggis/status/1440758396534214658?s=20 + + + ====Test Dataset==== * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/windows-sysmon.log -''version'': 6 +''version'': 7
---- ===Malicious powershell process - encoded command=== -This search looks for PowerShell processes that have encoded the script within the command-line. Malware has been seen using this parameter, as it obfuscates the code and makes it relatively easy to pass a script on the command-line. +The following analytic identifies the use of the EncodedCommand PowerShell parameter. This is typically used by Administrators to run complex scripts, but commonly used by adversaries to hide their code. \ +The analytic identifies all variations of EncodedCommand, as PowerShell allows the ability to shorten the parameter. For example enc, enco, encod and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. \ +During triage, review parallel events to determine legitimacy. Tune as needed based on admin scripts in use. \ +Alternatively, may use regex per matching here https://regexr.com/662ov. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint * '''ATT&CK''': [https://attack.mitre.org/techniques/T1027/ T1027] -* '''Last Updated''': 2020-07-21 +* '''Last Updated''': 2021-10-05
====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process=*-EncodedCommand* OR Processes.process=*-enc*) by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` +| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +| where match(process,"(?i)[\- +|\/ +|– +|— +|―]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]") | `malicious_powershell_process___encoded_command_filter` ====Associated Analytic Story==== @@ -31682,28 +31693,18 @@ To successfully implement this search you need to be ingesting information on pr * _time -* Processes.dest +* Processes.process_name + +* Processes.process * Processes.user * Processes.parent_process_name -* Processes.parent_process - -* Processes.original_file_name - -* Processes.process_name - -* Processes.process +* Processes.dest * Processes.process_id -* Processes.parent_process_path - -* Processes.process_path - -* Processes.parent_process_id - ====ATT&CK==== @@ -31731,12 +31732,22 @@ System administrators may use this option, but it's not common. ====Reference==== +* https://regexr.com/662ov + +* https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1 + +* https://ss64.com/ps/powershell.html + +* https://twitter.com/M_haggis/status/1440758396534214658?s=20 + + + ====Test Dataset==== * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/atomic_red_team/windows-sysmon.log -''version'': 5 +''version'': 6
@@ -40685,6 +40696,87 @@ unknown * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon.log +''version'': 1 + + + +---- + +===Remcos client registry install entry=== +This search detects registry key license at host where Remcos RAT agent is installed. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1112/ T1112] +* '''Last Updated''': 2021-09-24 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Registry.registry_path) as registry_path FROM datamodel=Endpoint.Registry where (Registry.registry_key_name=*\\Software\\Remcos*) by Registry.dest Registry.user Registry.registry_key_name Registry.process_id +| `drop_dm_object_name(Registry)` +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +|`remcos_client_registry_install_entry_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Remcos|Remcos]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_path + +* Registry.registry_key_name + +* Registry.process_id + +* Registry.dest + +* Registry.user + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1112 +| Modify Registry +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://attack.mitre.org/software/S0332/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_panel_client/remcos_registry_entry.log + + ''version'': 1
@@ -52378,7 +52470,7 @@ This search allows you to identify DNS requests and compute the standard deviati * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Network_Resolution * '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/003/ T1048.003] -* '''Last Updated''': 2021-07-21 +* '''Last Updated''': 2021-10-06
@@ -52387,12 +52479,16 @@ This search allows you to identify DNS requests and compute the standard deviati | tstats `security_content_summariesonly` count from datamodel=Network_Resolution where NOT DNS.message_type IN("Pointer","PTR") by DNS.query | `drop_dm_object_name("DNS")` +| eval tlds=split(query,".") +| eval tld=mvindex(tlds,-1) +| eval tld_len=len(tld) +| search tld_len<=24 | eval query_length = len(query) | table query query_length record_type count | eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50 | where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev -| `dns_query_length_with_high_standard_deviation_filter` +| `dns_query_length_with_high_standard_deviation_filter` ====Associated Analytic Story==== @@ -52442,7 +52538,7 @@ It's possible there can be long domain names that are legitimate. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/long_dns_queries/windows-sysmon.log -''version'': 3 +''version'': 4
@@ -55187,7 +55283,7 @@ There might be false positives associted with this detection since items like ar 
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content''
-# On Date: 2021-09-27 18:37:38.945952 UTC''
+# On Date: 2021-10-14 15:40:37.024104 UTC''
 # Author: Splunk Security Research''
 # Contact: research@splunk.com''
 #############
diff --git a/docs/index.markdown b/docs/index.markdown
index c1a88515e2..2a7fc944a3 100644
--- a/docs/index.markdown
+++ b/docs/index.markdown
@@ -9,12 +9,12 @@ header:
   actions:
     - label: "Download"
       url: "https://splunkbase.splunk.com/app/3449/"
-excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with over 400+ detections for Splunk."
+excerpt: "Get the latest **FREE** Enterprise Security Content Update (ESCU) App with **637** detections for Splunk."
 feature_row:
   - image_path: /static/feature_detection.png
     alt: "customizable"
     title: "Detections"
-    excerpt: "See all **636** Splunk Analytics built to find evil 😈."
+    excerpt: "See all **637** Splunk Analytics built to find evil 😈."
     url: "/detections"
     btn_class: "btn--primary"
     btn_label: "Explore"
@@ -28,7 +28,7 @@ feature_row:
   - image_path: /static/feature_playbooks.png
     alt: "100% free"
     title: "Playbooks"
-    excerpt: "See all **2** sets of steps 🐾 to automatically response to a threat."
+    excerpt: "See all **1** sets of steps 🐾 to automatically response to a threat."
     url: "/playbooks"
     btn_class: "btn--primary"
     btn_label: "Explore"
@@ -44,9 +44,9 @@ This project gives you access to our repository of Analytic Stories that are sec
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
 
 ## [Detection Coverage](https://mitremap.splunkresearch.com/) 🗺
-Below is a snapshot in time of what technique we currently have some detection coverage for. The darker the shade of blue the more detections we have for this particular technique. This map is automatically updated on every release and generated from the [generate-coverage-map.py](https://github.com/splunk/security_content/blob/develop/bin/generate-coverage-map.py).
+Below is a snapshot in time of what technique we currently have some detection coverage for. The darker the shade of blue the more detections we have for this particular technique.
 
-![](mitre-map/coverage.png)
+[![](mitre-map/coverage.png)](https://mitremap.splunkresearch.com/)
 
 ## View Our Content 🔎
 
diff --git a/docs/mitre-map/coverage.png b/docs/mitre-map/coverage.png
index a2fb672bff..4eb0f921f9 100644
Binary files a/docs/mitre-map/coverage.png and b/docs/mitre-map/coverage.png differ
diff --git a/docs/stories.wiki b/docs/stories.wiki
index 2681c7b479..aba2d27089 100644
--- a/docs/stories.wiki
+++ b/docs/stories.wiki
@@ -242,34 +242,10 @@ Monitor for activities and techniques associated with Discovery and Reconnaissan
 | [[Documentation:ESSOC:detections:Detections#Adsisearcher_account_discovery|AdsiSearcher Account Discovery]]
 
 |
-[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
-[https://attack.mitre.org/techniques/T1482/ T1482], 
-[https://attack.mitre.org/techniques/T1018/ T1018], 
-[https://attack.mitre.org/techniques/T1069.002/ T1069.002], 
-[https://attack.mitre.org/techniques/T1201/ T1201], 
-[https://attack.mitre.org/techniques/T1069.001/ T1069.001], 
-[https://attack.mitre.org/techniques/T1033/ T1033], 
-[https://attack.mitre.org/techniques/T1087.001/ T1087.001], 
-[https://attack.mitre.org/techniques/T1049/ T1049]
+[https://attack.mitre.org/techniques/T1087.002/ T1087.002]
 |
-Domain Account, 
-Domain Trust Discovery, 
-Remote System Discovery, 
-Domain Groups, 
-Password Policy Discovery, 
-Local Groups, 
-System Owner/User Discovery, 
-Local Account, 
-System Network Connections Discovery
+Domain Account
 |
-Discovery, 
-Discovery, 
-Discovery, 
-Discovery, 
-Discovery, 
-Discovery, 
-Discovery, 
-Discovery, 
 Discovery
 
 | TTP
@@ -277,13 +253,10 @@ Discovery
 | [[Documentation:ESSOC:detections:Detections#Dsquery_domain_discovery|DSQuery Domain Discovery]]
 
 |
-[https://attack.mitre.org/techniques/T1482/ T1482], 
-[https://attack.mitre.org/techniques/T1018/ T1018]
+[https://attack.mitre.org/techniques/T1482/ T1482]
 |
-Domain Trust Discovery, 
-Remote System Discovery
+Domain Trust Discovery
 |
-Discovery, 
 Discovery
 
 | TTP
@@ -1260,14 +1233,11 @@ Adversaries may abuse BITS jobs to persistently execute or clean up after malici
 | [[Documentation:ESSOC:detections:Detections#Bits_job_persistence|BITS Job Persistence]]
 
 |
-[https://attack.mitre.org/techniques/T1197/ T1197], 
-[https://attack.mitre.org/techniques/T1105/ T1105]
+[https://attack.mitre.org/techniques/T1197/ T1197]
 |
-BITS Jobs, 
-Ingress Tool Transfer
+BITS Jobs
 |
-Defense Evasion, Persistence, 
-Command And Control
+Defense Evasion, Persistence
 
 | TTP
 |-
@@ -1406,65 +1376,11 @@ Cobalt Strike is threat emulation software. Red teams and penetration testers us
 | [[Documentation:ESSOC:detections:Detections#Anomalous_usage_of_7zip|Anomalous usage of 7zip]]
 
 |
-[https://attack.mitre.org/techniques/T1560.001/ T1560.001], 
-[https://attack.mitre.org/techniques/T1059.003/ T1059.003], 
-[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
-[https://attack.mitre.org/techniques/T1055/ T1055], 
-[https://attack.mitre.org/techniques/T1071.002/ T1071.002], 
-[https://attack.mitre.org/techniques/T1218.010/ T1218.010], 
-[https://attack.mitre.org/techniques/T1218.005/ T1218.005], 
-[https://attack.mitre.org/techniques/T1569.002/ T1569.002], 
-[https://attack.mitre.org/techniques/T1027/ T1027], 
-[https://attack.mitre.org/techniques/T1218.011/ T1218.011], 
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
-[https://attack.mitre.org/techniques/T1548/ T1548], 
-[https://attack.mitre.org/techniques/T1203/ T1203], 
-[https://attack.mitre.org/techniques/T1505.003/ T1505.003], 
-[https://attack.mitre.org/techniques/T1127.001/ T1127.001], 
-[https://attack.mitre.org/techniques/T1036.003/ T1036.003], 
-[https://attack.mitre.org/techniques/T1127/ T1127], 
-[https://attack.mitre.org/techniques/T1071.001/ T1071.001], 
-[https://attack.mitre.org/techniques/T1018/ T1018]
+[https://attack.mitre.org/techniques/T1560.001/ T1560.001]
 |
-Archive via Utility, 
-Windows Command Shell, 
-Windows Service, 
-Process Injection, 
-File Transfer Protocols, 
-Regsvr32, 
-Mshta, 
-Service Execution, 
-Obfuscated Files or Information, 
-Rundll32, 
-Scheduled Task, 
-Abuse Elevation Control Mechanism, 
-Exploitation for Client Execution, 
-Web Shell, 
-MSBuild, 
-Rename System Utilities, 
-Trusted Developer Utilities Proxy Execution, 
-Web Protocols, 
-Remote System Discovery
+Archive via Utility
 |
-Collection, 
-Execution, 
-Persistence, Privilege Escalation, 
-Defense Evasion, Privilege Escalation, 
-Command And Control, 
-Defense Evasion, 
-Defense Evasion, 
-Execution, 
-Defense Evasion, 
-Defense Evasion, 
-Execution, Persistence, Privilege Escalation, 
-Privilege Escalation, Defense Evasion, 
-Execution, 
-Persistence, 
-Defense Evasion, 
-Defense Evasion, 
-Defense Evasion, 
-Command And Control, 
-Discovery
+Collection
 
 | Anomaly
 |-
@@ -1713,20 +1629,11 @@ Monitor for and investigate activities--such as suspicious writes to the Windows
 | [[Documentation:ESSOC:detections:Detections#Detect_renamed_7-zip|Detect Renamed 7-Zip]]
 
 |
-[https://attack.mitre.org/techniques/T1560.001/ T1560.001], 
-[https://attack.mitre.org/techniques/T1114.001/ T1114.001], 
-[https://attack.mitre.org/techniques/T1114.002/ T1114.002], 
-[https://attack.mitre.org/techniques/T1036/ T1036]
+[https://attack.mitre.org/techniques/T1560.001/ T1560.001]
 |
-Archive via Utility, 
-Local Email Collection, 
-Remote Email Collection, 
-Masquerading
+Archive via Utility
 |
-Collection, 
-Collection, 
-Collection, 
-Defense Evasion
+Collection
 
 | Hunting
 |-
@@ -1830,41 +1737,11 @@ Detect and investigate tactics, techniques, and procedures leveraged by attacker
 | [[Documentation:ESSOC:detections:Detections#Dns_exfiltration_using_nslookup_app|DNS Exfiltration Using Nslookup App]]
 
 |
-[https://attack.mitre.org/techniques/T1048/ T1048], 
-[https://attack.mitre.org/techniques/T1071.004/ T1071.004], 
-[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
-[https://attack.mitre.org/techniques/T1095/ T1095], 
-[https://attack.mitre.org/techniques/T1041/ T1041], 
-[https://attack.mitre.org/techniques/T1189/ T1189], 
-[https://attack.mitre.org/techniques/T1537/ T1537], 
-[https://attack.mitre.org/techniques/T1114.001/ T1114.001], 
-[https://attack.mitre.org/techniques/T1114/ T1114], 
-[https://attack.mitre.org/techniques/T1114.003/ T1114.003], 
-[https://attack.mitre.org/techniques/T1071.001/ T1071.001]
+[https://attack.mitre.org/techniques/T1048/ T1048]
 |
-Exfiltration Over Alternative Protocol, 
-DNS, 
-Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
-Non-Application Layer Protocol, 
-Exfiltration Over C2 Channel, 
-Drive-by Compromise, 
-Transfer Data to Cloud Account, 
-Local Email Collection, 
-Email Collection, 
-Email Forwarding Rule, 
-Web Protocols
+Exfiltration Over Alternative Protocol
 |
-Exfiltration, 
-Command And Control, 
-Exfiltration, 
-Command And Control, 
-Exfiltration, 
-Initial Access, 
-Exfiltration, 
-Collection, 
-Collection, 
-Collection, 
-Command And Control
+Exfiltration
 
 | TTP
 |-
@@ -2046,71 +1923,11 @@ Uncover activity consistent with credential dumping, a technique wherein attacke
 | [[Documentation:ESSOC:detections:Detections#Access_lsass_memory_for_dump_creation|Access LSASS Memory for Dump Creation]]
 
 |
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
-[https://attack.mitre.org/techniques/T1055/ T1055], 
-[https://attack.mitre.org/techniques/T1068/ T1068], 
-[https://attack.mitre.org/techniques/T1078/ T1078], 
-[https://attack.mitre.org/techniques/T1098/ T1098], 
-[https://attack.mitre.org/techniques/T1134/ T1134], 
-[https://attack.mitre.org/techniques/T1543/ T1543], 
-[https://attack.mitre.org/techniques/T1547/ T1547], 
-[https://attack.mitre.org/techniques/T1548/ T1548], 
-[https://attack.mitre.org/techniques/T1554/ T1554], 
-[https://attack.mitre.org/techniques/T1556/ T1556], 
-[https://attack.mitre.org/techniques/T1558/ T1558], 
-[https://attack.mitre.org/techniques/T1555/ T1555], 
-[https://attack.mitre.org/techniques/T1087/ T1087], 
-[https://attack.mitre.org/techniques/T1201/ T1201], 
-[https://attack.mitre.org/techniques/T1552/ T1552], 
-[https://attack.mitre.org/techniques/T1003/ T1003], 
-[https://attack.mitre.org/techniques/T1003.002/ T1003.002], 
-[https://attack.mitre.org/techniques/T1003.003/ T1003.003], 
-[https://attack.mitre.org/techniques/T1558.003/ T1558.003], 
-[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
+[https://attack.mitre.org/techniques/T1003.001/ T1003.001]
 |
-LSASS Memory, 
-Process Injection, 
-Exploitation for Privilege Escalation, 
-Valid Accounts, 
-Account Manipulation, 
-Access Token Manipulation, 
-Create or Modify System Process, 
-Boot or Logon Autostart Execution, 
-Abuse Elevation Control Mechanism, 
-Compromise Client Software Binary, 
-Modify Authentication Process, 
-Steal or Forge Kerberos Tickets, 
-Credentials from Password Stores, 
-Account Discovery, 
-Password Policy Discovery, 
-Unsecured Credentials, 
-OS Credential Dumping, 
-Security Account Manager, 
-NTDS, 
-Kerberoasting, 
-PowerShell
+LSASS Memory
 |
-Credential Access, 
-Defense Evasion, Privilege Escalation, 
-Privilege Escalation, 
-Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
-Persistence, 
-Defense Evasion, Privilege Escalation, 
-Persistence, Privilege Escalation, 
-Persistence, Privilege Escalation, 
-Privilege Escalation, Defense Evasion, 
-Persistence, 
-Credential Access, Defense Evasion, Persistence, 
-Credential Access, 
-Credential Access, 
-Discovery, 
-Discovery, 
-Credential Access, 
-Credential Access, 
-Credential Access, 
-Credential Access, 
-Credential Access, 
-Execution
+Credential Access
 
 | TTP
 |-
@@ -2236,44 +2053,11 @@ Credential Access
 | [[Documentation:ESSOC:detections:Detections#Attempted_credential_dump_from_registry_via_reg_exe|Attempted Credential Dump From Registry via Reg exe]]
 
 |
-[https://attack.mitre.org/techniques/T1003.002/ T1003.002], 
-[https://attack.mitre.org/techniques/T1197/ T1197], 
-[https://attack.mitre.org/techniques/T1105/ T1105], 
-[https://attack.mitre.org/techniques/T1218.003/ T1218.003], 
-[https://attack.mitre.org/techniques/T1055/ T1055], 
-[https://attack.mitre.org/techniques/T1490/ T1490], 
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
-[https://attack.mitre.org/techniques/T1020/ T1020], 
-[https://attack.mitre.org/techniques/T1569.002/ T1569.002], 
-[https://attack.mitre.org/techniques/T1486/ T1486], 
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002]
+[https://attack.mitre.org/techniques/T1003.002/ T1003.002]
 |
-Security Account Manager, 
-BITS Jobs, 
-Ingress Tool Transfer, 
-CMSTP, 
-Process Injection, 
-Inhibit System Recovery, 
-LSASS Memory, 
-SMB/Windows Admin Shares, 
-Automated Exfiltration, 
-Service Execution, 
-Data Encrypted for Impact, 
-Bypass User Account Control
+Security Account Manager
 |
-Credential Access, 
-Defense Evasion, Persistence, 
-Command And Control, 
-Defense Evasion, 
-Defense Evasion, Privilege Escalation, 
-Impact, 
-Credential Access, 
-Lateral Movement, 
-Exfiltration, 
-Execution, 
-Impact, 
-Privilege Escalation, Defense Evasion
+Credential Access
 
 | TTP
 |-
@@ -2703,41 +2487,11 @@ The stealing of data by an adversary.
 | [[Documentation:ESSOC:detections:Detections#Dns_exfiltration_using_nslookup_app|DNS Exfiltration Using Nslookup App]]
 
 |
-[https://attack.mitre.org/techniques/T1048/ T1048], 
-[https://attack.mitre.org/techniques/T1071.004/ T1071.004], 
-[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
-[https://attack.mitre.org/techniques/T1095/ T1095], 
-[https://attack.mitre.org/techniques/T1041/ T1041], 
-[https://attack.mitre.org/techniques/T1189/ T1189], 
-[https://attack.mitre.org/techniques/T1537/ T1537], 
-[https://attack.mitre.org/techniques/T1114.001/ T1114.001], 
-[https://attack.mitre.org/techniques/T1114/ T1114], 
-[https://attack.mitre.org/techniques/T1114.003/ T1114.003], 
-[https://attack.mitre.org/techniques/T1071.001/ T1071.001]
+[https://attack.mitre.org/techniques/T1048/ T1048]
 |
-Exfiltration Over Alternative Protocol, 
-DNS, 
-Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
-Non-Application Layer Protocol, 
-Exfiltration Over C2 Channel, 
-Drive-by Compromise, 
-Transfer Data to Cloud Account, 
-Local Email Collection, 
-Email Collection, 
-Email Forwarding Rule, 
-Web Protocols
+Exfiltration Over Alternative Protocol
 |
-Exfiltration, 
-Command And Control, 
-Exfiltration, 
-Command And Control, 
-Exfiltration, 
-Initial Access, 
-Exfiltration, 
-Collection, 
-Collection, 
-Collection, 
-Command And Control
+Exfiltration
 
 | TTP
 |-
@@ -2932,17 +2686,11 @@ Uncover activity related to the execution of Zerologon CVE-2020-11472, a techniq
 | [[Documentation:ESSOC:detections:Detections#Detect_computer_changed_with_anonymous_account|Detect Computer Changed with Anonymous Account]]
 
 |
-[https://attack.mitre.org/techniques/T1210/ T1210], 
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
-[https://attack.mitre.org/techniques/T1190/ T1190]
+[https://attack.mitre.org/techniques/T1210/ T1210]
 |
-Exploitation of Remote Services, 
-LSASS Memory, 
-Exploit Public-Facing Application
+Exploitation of Remote Services
 |
-Lateral Movement, 
-Credential Access, 
-Initial Access
+Lateral Movement
 
 | Hunting
 |-
@@ -3026,22 +2774,10 @@ Looks for activities and techniques associated with the disabling of security to
 | [[Documentation:ESSOC:detections:Detections#Attempt_to_add_certificate_to_untrusted_store|Attempt To Add Certificate To Untrusted Store]]
 
 |
-[https://attack.mitre.org/techniques/T1553.004/ T1553.004], 
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
-[https://attack.mitre.org/techniques/T1562.004/ T1562.004], 
-[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
-[https://attack.mitre.org/techniques/T1112/ T1112]
+[https://attack.mitre.org/techniques/T1553.004/ T1553.004]
 |
-Install Root Certificate, 
-Disable or Modify Tools, 
-Disable or Modify System Firewall, 
-Windows Service, 
-Modify Registry
+Install Root Certificate
 |
-Defense Evasion, 
-Defense Evasion, 
-Defense Evasion, 
-Persistence, Privilege Escalation, 
 Defense Evasion
 
 | TTP
@@ -3146,13 +2882,10 @@ Adversaries may attempt to gather information on domain trust relationships that
 | [[Documentation:ESSOC:detections:Detections#Dsquery_domain_discovery|DSQuery Domain Discovery]]
 
 |
-[https://attack.mitre.org/techniques/T1482/ T1482], 
-[https://attack.mitre.org/techniques/T1018/ T1018]
+[https://attack.mitre.org/techniques/T1482/ T1482]
 |
-Domain Trust Discovery, 
-Remote System Discovery
+Domain Trust Discovery
 |
-Discovery, 
 Discovery
 
 | TTP
@@ -3269,52 +3002,22 @@ HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVE
 | [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadstring|Any Powershell DownloadString]]
 
 |
-[https://attack.mitre.org/techniques/T1059.001/ T1059.001], 
-[https://attack.mitre.org/techniques/T1505.003/ T1505.003], 
-[https://attack.mitre.org/techniques/T1136.001/ T1136.001], 
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
-[https://attack.mitre.org/techniques/T1569.002/ T1569.002], 
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
-[https://attack.mitre.org/techniques/T1114.002/ T1114.002], 
-[https://attack.mitre.org/techniques/T1003.003/ T1003.003], 
-[https://attack.mitre.org/techniques/T1190/ T1190]
+[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
-PowerShell, 
-Web Shell, 
-Local Account, 
-SMB/Windows Admin Shares, 
-Service Execution, 
-LSASS Memory, 
-Remote Email Collection, 
-NTDS, 
-Exploit Public-Facing Application
+PowerShell
 |
-Execution, 
-Persistence, 
-Persistence, 
-Lateral Movement, 
-Execution, 
-Credential Access, 
-Collection, 
-Credential Access, 
-Initial Access
+Execution
 
 | TTP
 |-
 | [[Documentation:ESSOC:detections:Detections#Detect_exchange_web_shell|Detect Exchange Web Shell]]
 
 |
-[https://attack.mitre.org/techniques/T1505.003/ T1505.003], 
-[https://attack.mitre.org/techniques/T1190/ T1190], 
-[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
+[https://attack.mitre.org/techniques/T1505.003/ T1505.003]
 |
-Web Shell, 
-Exploit Public-Facing Application, 
-PowerShell
+Web Shell
 |
-Persistence, 
-Initial Access, 
-Execution
+Persistence
 
 | TTP
 |-
@@ -3387,16 +3090,13 @@ Collection
 | [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_connect_to_internet_with_hidden_window|Malicious PowerShell Process - Connect To Internet With Hidden Window]]
 
 |
-[https://attack.mitre.org/techniques/T1059.001/ T1059.001], 
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001]
+[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
-PowerShell, 
-Registry Run Keys / Startup Folder
+PowerShell
 |
-Execution, 
-Persistence, Privilege Escalation
+Execution
 
-| TTP
+| Hunting
 |-
 | [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_execution_policy_bypass|Malicious PowerShell Process - Execution Policy Bypass]]
 
@@ -3519,103 +3219,22 @@ Adversaries may transfer tools or other files from an external system into a com
 | [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadfile|Any Powershell DownloadFile]]
 
 |
-[https://attack.mitre.org/techniques/T1059.001/ T1059.001], 
-[https://attack.mitre.org/techniques/T1197/ T1197], 
-[https://attack.mitre.org/techniques/T1105/ T1105], 
-[https://attack.mitre.org/techniques/T1003/ T1003], 
-[https://attack.mitre.org/techniques/T1021/ T1021], 
-[https://attack.mitre.org/techniques/T1113/ T1113], 
-[https://attack.mitre.org/techniques/T1123/ T1123], 
-[https://attack.mitre.org/techniques/T1563/ T1563], 
-[https://attack.mitre.org/techniques/T1053/ T1053], 
-[https://attack.mitre.org/techniques/T1134/ T1134], 
-[https://attack.mitre.org/techniques/T1548/ T1548], 
-[https://attack.mitre.org/techniques/T1055/ T1055], 
-[https://attack.mitre.org/techniques/T1106/ T1106], 
-[https://attack.mitre.org/techniques/T1569/ T1569], 
-[https://attack.mitre.org/techniques/T1027/ T1027], 
-[https://attack.mitre.org/techniques/T1027.005/ T1027.005], 
-[https://attack.mitre.org/techniques/T1546.015/ T1546.015], 
-[https://attack.mitre.org/techniques/T1140/ T1140], 
-[https://attack.mitre.org/techniques/T1592/ T1592], 
-[https://attack.mitre.org/techniques/T1562/ T1562]
+[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
-PowerShell, 
-BITS Jobs, 
-Ingress Tool Transfer, 
-OS Credential Dumping, 
-Remote Services, 
-Screen Capture, 
-Audio Capture, 
-Remote Service Session Hijacking, 
-Scheduled Task/Job, 
-Access Token Manipulation, 
-Abuse Elevation Control Mechanism, 
-Process Injection, 
-Native API, 
-System Services, 
-Obfuscated Files or Information, 
-Indicator Removal from Tools, 
-Component Object Model Hijacking, 
-Deobfuscate/Decode Files or Information, 
-Gather Victim Host Information, 
-Impair Defenses
+PowerShell
 |
-Execution, 
-Defense Evasion, Persistence, 
-Command And Control, 
-Credential Access, 
-Lateral Movement, 
-Collection, 
-Collection, 
-Lateral Movement, 
-Execution, Persistence, Privilege Escalation, 
-Defense Evasion, Privilege Escalation, 
-Privilege Escalation, Defense Evasion, 
-Defense Evasion, Privilege Escalation, 
-Execution, 
-Execution, 
-Defense Evasion, 
-Defense Evasion, 
-Privilege Escalation, Persistence, 
-Defense Evasion, 
-Reconnaissance, 
-Defense Evasion
+Execution
 
 | TTP
 |-
 | [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadstring|Any Powershell DownloadString]]
 
 |
-[https://attack.mitre.org/techniques/T1059.001/ T1059.001], 
-[https://attack.mitre.org/techniques/T1505.003/ T1505.003], 
-[https://attack.mitre.org/techniques/T1136.001/ T1136.001], 
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
-[https://attack.mitre.org/techniques/T1569.002/ T1569.002], 
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
-[https://attack.mitre.org/techniques/T1114.002/ T1114.002], 
-[https://attack.mitre.org/techniques/T1003.003/ T1003.003], 
-[https://attack.mitre.org/techniques/T1190/ T1190]
+[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
-PowerShell, 
-Web Shell, 
-Local Account, 
-SMB/Windows Admin Shares, 
-Service Execution, 
-LSASS Memory, 
-Remote Email Collection, 
-NTDS, 
-Exploit Public-Facing Application
+PowerShell
 |
-Execution, 
-Persistence, 
-Persistence, 
-Lateral Movement, 
-Execution, 
-Credential Access, 
-Collection, 
-Credential Access, 
-Initial Access
+Execution
 
 | TTP
 |-
@@ -3658,17 +3277,11 @@ Command And Control
 | [[Documentation:ESSOC:detections:Detections#Suspicious_curl_network_connection|Suspicious Curl Network Connection]]
 
 |
-[https://attack.mitre.org/techniques/T1105/ T1105], 
-[https://attack.mitre.org/techniques/T1543.001/ T1543.001], 
-[https://attack.mitre.org/techniques/T1074/ T1074]
+[https://attack.mitre.org/techniques/T1105/ T1105]
 |
-Ingress Tool Transfer, 
-Launch Agent, 
-Data Staged
+Ingress Tool Transfer
 |
-Command And Control, 
-Persistence, Privilege Escalation, 
-Collection
+Command And Control
 
 | TTP
 |}
@@ -3713,26 +3326,11 @@ Detect and investigate tactics, techniques, and procedures around how attackers
 | [[Documentation:ESSOC:detections:Detections#Detect_activity_related_to_pass_the_hash_attacks|Detect Activity Related to Pass the Hash Attacks]]
 
 |
-[https://attack.mitre.org/techniques/T1550.002/ T1550.002], 
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
-[https://attack.mitre.org/techniques/T1569.002/ T1569.002], 
-[https://attack.mitre.org/techniques/T1558.003/ T1558.003], 
-[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005]
+[https://attack.mitre.org/techniques/T1550.002/ T1550.002]
 |
-Pass the Hash, 
-SMB/Windows Admin Shares, 
-Service Execution, 
-Kerberoasting, 
-Remote Desktop Protocol, 
-Scheduled Task
+Pass the Hash
 |
-Defense Evasion, Lateral Movement, 
-Lateral Movement, 
-Execution, 
-Credential Access, 
-Lateral Movement, 
-Execution, Persistence, Privilege Escalation
+Defense Evasion, Lateral Movement
 
 | TTP
 |-
@@ -3880,103 +3478,22 @@ Attackers are finding stealthy ways "live off the land," leveraging utilities an
 | [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadfile|Any Powershell DownloadFile]]
 
 |
-[https://attack.mitre.org/techniques/T1059.001/ T1059.001], 
-[https://attack.mitre.org/techniques/T1197/ T1197], 
-[https://attack.mitre.org/techniques/T1105/ T1105], 
-[https://attack.mitre.org/techniques/T1003/ T1003], 
-[https://attack.mitre.org/techniques/T1021/ T1021], 
-[https://attack.mitre.org/techniques/T1113/ T1113], 
-[https://attack.mitre.org/techniques/T1123/ T1123], 
-[https://attack.mitre.org/techniques/T1563/ T1563], 
-[https://attack.mitre.org/techniques/T1053/ T1053], 
-[https://attack.mitre.org/techniques/T1134/ T1134], 
-[https://attack.mitre.org/techniques/T1548/ T1548], 
-[https://attack.mitre.org/techniques/T1055/ T1055], 
-[https://attack.mitre.org/techniques/T1106/ T1106], 
-[https://attack.mitre.org/techniques/T1569/ T1569], 
-[https://attack.mitre.org/techniques/T1027/ T1027], 
-[https://attack.mitre.org/techniques/T1027.005/ T1027.005], 
-[https://attack.mitre.org/techniques/T1546.015/ T1546.015], 
-[https://attack.mitre.org/techniques/T1140/ T1140], 
-[https://attack.mitre.org/techniques/T1592/ T1592], 
-[https://attack.mitre.org/techniques/T1562/ T1562]
+[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
-PowerShell, 
-BITS Jobs, 
-Ingress Tool Transfer, 
-OS Credential Dumping, 
-Remote Services, 
-Screen Capture, 
-Audio Capture, 
-Remote Service Session Hijacking, 
-Scheduled Task/Job, 
-Access Token Manipulation, 
-Abuse Elevation Control Mechanism, 
-Process Injection, 
-Native API, 
-System Services, 
-Obfuscated Files or Information, 
-Indicator Removal from Tools, 
-Component Object Model Hijacking, 
-Deobfuscate/Decode Files or Information, 
-Gather Victim Host Information, 
-Impair Defenses
+PowerShell
 |
-Execution, 
-Defense Evasion, Persistence, 
-Command And Control, 
-Credential Access, 
-Lateral Movement, 
-Collection, 
-Collection, 
-Lateral Movement, 
-Execution, Persistence, Privilege Escalation, 
-Defense Evasion, Privilege Escalation, 
-Privilege Escalation, Defense Evasion, 
-Defense Evasion, Privilege Escalation, 
-Execution, 
-Execution, 
-Defense Evasion, 
-Defense Evasion, 
-Privilege Escalation, Persistence, 
-Defense Evasion, 
-Reconnaissance, 
-Defense Evasion
+Execution
 
 | TTP
 |-
 | [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadstring|Any Powershell DownloadString]]
 
 |
-[https://attack.mitre.org/techniques/T1059.001/ T1059.001], 
-[https://attack.mitre.org/techniques/T1505.003/ T1505.003], 
-[https://attack.mitre.org/techniques/T1136.001/ T1136.001], 
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
-[https://attack.mitre.org/techniques/T1569.002/ T1569.002], 
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
-[https://attack.mitre.org/techniques/T1114.002/ T1114.002], 
-[https://attack.mitre.org/techniques/T1003.003/ T1003.003], 
-[https://attack.mitre.org/techniques/T1190/ T1190]
+[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
-PowerShell, 
-Web Shell, 
-Local Account, 
-SMB/Windows Admin Shares, 
-Service Execution, 
-LSASS Memory, 
-Remote Email Collection, 
-NTDS, 
-Exploit Public-Facing Application
+PowerShell
 |
-Execution, 
-Persistence, 
-Persistence, 
-Lateral Movement, 
-Execution, 
-Credential Access, 
-Collection, 
-Credential Access, 
-Initial Access
+Execution
 
 | TTP
 |-
@@ -4103,16 +3620,13 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_connect_to_internet_with_hidden_window|Malicious PowerShell Process - Connect To Internet With Hidden Window]]
 
 |
-[https://attack.mitre.org/techniques/T1059.001/ T1059.001], 
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001]
+[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
-PowerShell, 
-Registry Run Keys / Startup Folder
+PowerShell
 |
-Execution, 
-Persistence, Privilege Escalation
+Execution
 
-| TTP
+| Hunting
 |-
 | [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_encoded_command|Malicious PowerShell Process - Encoded Command]]
 
@@ -4358,22 +3872,10 @@ Adversaries may rename legitimate system utilities to try to evade security mech
 | [[Documentation:ESSOC:detections:Detections#Execution_of_file_with_multiple_extensions|Execution of File with Multiple Extensions]]
 
 |
-[https://attack.mitre.org/techniques/T1036.003/ T1036.003], 
-[https://attack.mitre.org/techniques/T1127.001/ T1127.001], 
-[https://attack.mitre.org/techniques/T1218.011/ T1218.011], 
-[https://attack.mitre.org/techniques/T1127/ T1127], 
-[https://attack.mitre.org/techniques/T1036/ T1036]
+[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
 |
-Rename System Utilities, 
-MSBuild, 
-Rundll32, 
-Trusted Developer Utilities Proxy Execution, 
-Masquerading
+Rename System Utilities
 |
-Defense Evasion, 
-Defense Evasion, 
-Defense Evasion, 
-Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -4494,6 +3996,17 @@ Meterpreter provides red teams, pen testers and threat actors interactive access
 ! Tactic
 ! Type
 |-
+| [[Documentation:ESSOC:detections:Detections#Excessive_number_of_distinct_processes_created_in_windows_temp_folder|Excessive number of distinct processes created in Windows Temp folder]]
+
+|
+[https://attack.mitre.org/techniques/T1059/ T1059]
+|
+Command and Scripting Interpreter
+|
+Execution
+
+| Anomaly
+|-
 | [[Documentation:ESSOC:detections:Detections#Excessive_number_of_taskhost_processes|Excessive number of taskhost processes]]
 
 |
@@ -4548,16 +4061,10 @@ CVE-2021-40444 is a remote code execution vulnerability in MSHTML, recently used
 | [[Documentation:ESSOC:detections:Detections#Control_loading_from_world_writable_directory|Control Loading from World Writable Directory]]
 
 |
-[https://attack.mitre.org/techniques/T1218.002/ T1218.002], 
-[https://attack.mitre.org/techniques/T1566.001/ T1566.001], 
-[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
+[https://attack.mitre.org/techniques/T1218.002/ T1218.002]
 |
-Control Panel, 
-Spearphishing Attachment, 
-Rundll32
+Control Panel
 |
-Defense Evasion, 
-Initial Access, 
 Defense Evasion
 
 | TTP
@@ -4660,65 +4167,11 @@ Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and managemen
 | [[Documentation:ESSOC:detections:Detections#Anomalous_usage_of_7zip|Anomalous usage of 7zip]]
 
 |
-[https://attack.mitre.org/techniques/T1560.001/ T1560.001], 
-[https://attack.mitre.org/techniques/T1059.003/ T1059.003], 
-[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
-[https://attack.mitre.org/techniques/T1055/ T1055], 
-[https://attack.mitre.org/techniques/T1071.002/ T1071.002], 
-[https://attack.mitre.org/techniques/T1218.010/ T1218.010], 
-[https://attack.mitre.org/techniques/T1218.005/ T1218.005], 
-[https://attack.mitre.org/techniques/T1569.002/ T1569.002], 
-[https://attack.mitre.org/techniques/T1027/ T1027], 
-[https://attack.mitre.org/techniques/T1218.011/ T1218.011], 
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
-[https://attack.mitre.org/techniques/T1548/ T1548], 
-[https://attack.mitre.org/techniques/T1203/ T1203], 
-[https://attack.mitre.org/techniques/T1505.003/ T1505.003], 
-[https://attack.mitre.org/techniques/T1127.001/ T1127.001], 
-[https://attack.mitre.org/techniques/T1036.003/ T1036.003], 
-[https://attack.mitre.org/techniques/T1127/ T1127], 
-[https://attack.mitre.org/techniques/T1071.001/ T1071.001], 
-[https://attack.mitre.org/techniques/T1018/ T1018]
+[https://attack.mitre.org/techniques/T1560.001/ T1560.001]
 |
-Archive via Utility, 
-Windows Command Shell, 
-Windows Service, 
-Process Injection, 
-File Transfer Protocols, 
-Regsvr32, 
-Mshta, 
-Service Execution, 
-Obfuscated Files or Information, 
-Rundll32, 
-Scheduled Task, 
-Abuse Elevation Control Mechanism, 
-Exploitation for Client Execution, 
-Web Shell, 
-MSBuild, 
-Rename System Utilities, 
-Trusted Developer Utilities Proxy Execution, 
-Web Protocols, 
-Remote System Discovery
+Archive via Utility
 |
-Collection, 
-Execution, 
-Persistence, Privilege Escalation, 
-Defense Evasion, Privilege Escalation, 
-Command And Control, 
-Defense Evasion, 
-Defense Evasion, 
-Execution, 
-Defense Evasion, 
-Defense Evasion, 
-Execution, Persistence, Privilege Escalation, 
-Privilege Escalation, Defense Evasion, 
-Execution, 
-Persistence, 
-Defense Evasion, 
-Defense Evasion, 
-Defense Evasion, 
-Command And Control, 
-Discovery
+Collection
 
 | Anomaly
 |-
@@ -4736,20 +4189,11 @@ Command And Control
 | [[Documentation:ESSOC:detections:Detections#Detect_prohibited_applications_spawning_cmd_exe|Detect Prohibited Applications Spawning cmd exe]]
 
 |
-[https://attack.mitre.org/techniques/T1059.003/ T1059.003], 
-[https://attack.mitre.org/techniques/T1059/ T1059], 
-[https://attack.mitre.org/techniques/T1068/ T1068], 
-[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
+[https://attack.mitre.org/techniques/T1059.003/ T1059.003]
 |
-Windows Command Shell, 
-Command and Scripting Interpreter, 
-Exploitation for Privilege Escalation, 
-Rename System Utilities
+Windows Command Shell
 |
-Execution, 
-Execution, 
-Privilege Escalation, 
-Defense Evasion
+Execution
 
 | Hunting
 |-
@@ -4767,26 +4211,11 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#First_time_seen_running_windows_service|First Time Seen Running Windows Service]]
 
 |
-[https://attack.mitre.org/techniques/T1569.002/ T1569.002], 
-[https://attack.mitre.org/techniques/T1055/ T1055], 
-[https://attack.mitre.org/techniques/T1106/ T1106], 
-[https://attack.mitre.org/techniques/T1569/ T1569], 
-[https://attack.mitre.org/techniques/T1574.011/ T1574.011], 
-[https://attack.mitre.org/techniques/T1543.003/ T1543.003]
+[https://attack.mitre.org/techniques/T1569.002/ T1569.002]
 |
-Service Execution, 
-Process Injection, 
-Native API, 
-System Services, 
-Services Registry Permissions Weakness, 
-Windows Service
+Service Execution
 |
-Execution, 
-Defense Evasion, Privilege Escalation, 
-Execution, 
-Execution, 
-Persistence, Privilege Escalation, Defense Evasion, 
-Persistence, Privilege Escalation
+Execution
 
 | Anomaly
 |-
@@ -4931,13 +4360,10 @@ PetitPotam (CVE-2021-36942,) is a vulnerablity identified in Microsofts EFSRPC P
 | [[Documentation:ESSOC:detections:Detections#Petitpotam_network_share_access_request|PetitPotam Network Share Access Request]]
 
 |
-[https://attack.mitre.org/techniques/T1187/ T1187], 
-[https://attack.mitre.org/techniques/T1003/ T1003]
+[https://attack.mitre.org/techniques/T1187/ T1187]
 |
-Forced Authentication, 
-OS Credential Dumping
+Forced Authentication
 |
-Credential Access, 
 Credential Access
 
 | TTP
@@ -5006,16 +4432,13 @@ Monitor your environment for suspicious behaviors that resemble the techniques e
 | [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_connect_to_internet_with_hidden_window|Malicious PowerShell Process - Connect To Internet With Hidden Window]]
 
 |
-[https://attack.mitre.org/techniques/T1059.001/ T1059.001], 
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001]
+[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 |
-PowerShell, 
-Registry Run Keys / Startup Folder
+PowerShell
 |
-Execution, 
-Persistence, Privilege Escalation
+Execution
 
-| TTP
+| Hunting
 |-
 | [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
 
@@ -5087,17 +4510,11 @@ ProxyShell is a chain of exploits targeting on-premise Microsoft Exchange Server
 | [[Documentation:ESSOC:detections:Detections#Detect_exchange_web_shell|Detect Exchange Web Shell]]
 
 |
-[https://attack.mitre.org/techniques/T1505.003/ T1505.003], 
-[https://attack.mitre.org/techniques/T1190/ T1190], 
-[https://attack.mitre.org/techniques/T1059.001/ T1059.001]
+[https://attack.mitre.org/techniques/T1505.003/ T1505.003]
 |
-Web Shell, 
-Exploit Public-Facing Application, 
-PowerShell
+Web Shell
 |
-Persistence, 
-Initial Access, 
-Execution
+Persistence
 
 | TTP
 |-
@@ -5232,17 +4649,11 @@ Silver Sparrow, identified by Red Canary Intelligence, is a new forward looking
 | [[Documentation:ESSOC:detections:Detections#Suspicious_curl_network_connection|Suspicious Curl Network Connection]]
 
 |
-[https://attack.mitre.org/techniques/T1105/ T1105], 
-[https://attack.mitre.org/techniques/T1543.001/ T1543.001], 
-[https://attack.mitre.org/techniques/T1074/ T1074]
+[https://attack.mitre.org/techniques/T1105/ T1105]
 |
-Ingress Tool Transfer, 
-Launch Agent, 
-Data Staged
+Ingress Tool Transfer
 |
-Command And Control, 
-Persistence, Privilege Escalation, 
-Collection
+Command And Control
 
 | TTP
 |-
@@ -5320,16 +4731,10 @@ Detect signs of malicious payloads that may indicate that your environment has b
 | [[Documentation:ESSOC:detections:Detections#Detect_outlook_exe_writing_a_zip_file|Detect Outlook exe writing a zip file]]
 
 |
-[https://attack.mitre.org/techniques/T1566.001/ T1566.001], 
-[https://attack.mitre.org/techniques/T1003.002/ T1003.002], 
-[https://attack.mitre.org/techniques/T1566.002/ T1566.002]
+[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
 |
-Spearphishing Attachment, 
-Security Account Manager, 
-Spearphishing Link
+Spearphishing Attachment
 |
-Initial Access, 
-Credential Access, 
 Initial Access
 
 | TTP
@@ -5564,20 +4969,11 @@ Leveraging the Windows command-line interface (CLI) is one of the most common at
 | [[Documentation:ESSOC:detections:Detections#Detect_prohibited_applications_spawning_cmd_exe|Detect Prohibited Applications Spawning cmd exe]]
 
 |
-[https://attack.mitre.org/techniques/T1059.003/ T1059.003], 
-[https://attack.mitre.org/techniques/T1059/ T1059], 
-[https://attack.mitre.org/techniques/T1068/ T1068], 
-[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
+[https://attack.mitre.org/techniques/T1059.003/ T1059.003]
 |
-Windows Command Shell, 
-Command and Scripting Interpreter, 
-Exploitation for Privilege Escalation, 
-Rename System Utilities
+Windows Command Shell
 |
-Execution, 
-Execution, 
-Privilege Escalation, 
-Defense Evasion
+Execution
 
 | Hunting
 |-
@@ -5595,23 +4991,11 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Detect_use_of_cmd_exe_to_launch_script_interpreters|Detect Use of cmd exe to Launch Script Interpreters]]
 
 |
-[https://attack.mitre.org/techniques/T1059.003/ T1059.003], 
-[https://attack.mitre.org/techniques/T1072/ T1072], 
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
-[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
+[https://attack.mitre.org/techniques/T1059.003/ T1059.003]
 |
-Windows Command Shell, 
-Software Deployment Tools, 
-Registry Run Keys / Startup Folder, 
-SMB/Windows Admin Shares, 
-Spearphishing Attachment
+Windows Command Shell
 |
-Execution, 
-Execution, Lateral Movement, 
-Persistence, Privilege Escalation, 
-Lateral Movement, 
-Initial Access
+Execution
 
 | TTP
 |-
@@ -5771,41 +5155,11 @@ Attackers often attempt to hide within or otherwise abuse the domain name system
 | [[Documentation:ESSOC:detections:Detections#Dns_exfiltration_using_nslookup_app|DNS Exfiltration Using Nslookup App]]
 
 |
-[https://attack.mitre.org/techniques/T1048/ T1048], 
-[https://attack.mitre.org/techniques/T1071.004/ T1071.004], 
-[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
-[https://attack.mitre.org/techniques/T1095/ T1095], 
-[https://attack.mitre.org/techniques/T1041/ T1041], 
-[https://attack.mitre.org/techniques/T1189/ T1189], 
-[https://attack.mitre.org/techniques/T1537/ T1537], 
-[https://attack.mitre.org/techniques/T1114.001/ T1114.001], 
-[https://attack.mitre.org/techniques/T1114/ T1114], 
-[https://attack.mitre.org/techniques/T1114.003/ T1114.003], 
-[https://attack.mitre.org/techniques/T1071.001/ T1071.001]
+[https://attack.mitre.org/techniques/T1048/ T1048]
 |
-Exfiltration Over Alternative Protocol, 
-DNS, 
-Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
-Non-Application Layer Protocol, 
-Exfiltration Over C2 Channel, 
-Drive-by Compromise, 
-Transfer Data to Cloud Account, 
-Local Email Collection, 
-Email Collection, 
-Email Forwarding Rule, 
-Web Protocols
+Exfiltration Over Alternative Protocol
 |
-Exfiltration, 
-Command And Control, 
-Exfiltration, 
-Command And Control, 
-Exfiltration, 
-Initial Access, 
-Exfiltration, 
-Collection, 
-Collection, 
-Collection, 
-Command And Control
+Exfiltration
 
 | TTP
 |-
@@ -5974,40 +5328,22 @@ Monitor and detect techniques used by attackers who leverage the mshta.exe proce
 | [[Documentation:ESSOC:detections:Detections#Detect_mshta_url_in_command_line|Detect MSHTA Url in Command Line]]
 
 |
-[https://attack.mitre.org/techniques/T1218.005/ T1218.005], 
-[https://attack.mitre.org/techniques/T1059.003/ T1059.003], 
-[https://attack.mitre.org/techniques/T1059/ T1059], 
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001]
+[https://attack.mitre.org/techniques/T1218.005/ T1218.005]
 |
-Mshta, 
-Windows Command Shell, 
-Command and Scripting Interpreter, 
-Registry Run Keys / Startup Folder
+Mshta
 |
-Defense Evasion, 
-Execution, 
-Execution, 
-Persistence, Privilege Escalation
+Defense Evasion
 
 | TTP
 |-
 | [[Documentation:ESSOC:detections:Detections#Detect_prohibited_applications_spawning_cmd_exe|Detect Prohibited Applications Spawning cmd exe]]
 
 |
-[https://attack.mitre.org/techniques/T1059.003/ T1059.003], 
-[https://attack.mitre.org/techniques/T1059/ T1059], 
-[https://attack.mitre.org/techniques/T1068/ T1068], 
-[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
+[https://attack.mitre.org/techniques/T1059.003/ T1059.003]
 |
-Windows Command Shell, 
-Command and Scripting Interpreter, 
-Exploitation for Privilege Escalation, 
-Rename System Utilities
+Windows Command Shell
 |
-Execution, 
-Execution, 
-Privilege Escalation, 
-Defense Evasion
+Execution
 
 | Hunting
 |-
@@ -6385,16 +5721,10 @@ Monitor and detect techniques used by attackers who leverage rundll32.exe to exe
 | [[Documentation:ESSOC:detections:Detections#Detect_rundll32_application_control_bypass_-_advpack|Detect Rundll32 Application Control Bypass - advpack]]
 
 |
-[https://attack.mitre.org/techniques/T1218.011/ T1218.011], 
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
-[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
+[https://attack.mitre.org/techniques/T1218.011/ T1218.011]
 |
-Rundll32, 
-LSASS Memory, 
-Rename System Utilities
+Rundll32
 |
-Defense Evasion, 
-Credential Access, 
 Defense Evasion
 
 | TTP
@@ -6557,14 +5887,11 @@ Attackers are increasingly abusing Windows Management Instrumentation (WMI), a f
 | [[Documentation:ESSOC:detections:Detections#Detect_wmi_event_subscription_persistence|Detect WMI Event Subscription Persistence]]
 
 |
-[https://attack.mitre.org/techniques/T1546.003/ T1546.003], 
-[https://attack.mitre.org/techniques/T1047/ T1047]
+[https://attack.mitre.org/techniques/T1546.003/ T1546.003]
 |
-Windows Management Instrumentation Event Subscription, 
-Windows Management Instrumentation
+Windows Management Instrumentation Event Subscription
 |
-Privilege Escalation, Persistence, 
-Execution
+Privilege Escalation, Persistence
 
 | TTP
 |-
@@ -6688,35 +6015,11 @@ Monitor and detect registry changes initiated from remote locations, which can b
 | [[Documentation:ESSOC:detections:Detections#Disabling_remote_user_account_control|Disabling Remote User Account Control]]
 
 |
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
-[https://attack.mitre.org/techniques/T1036/ T1036], 
-[https://attack.mitre.org/techniques/T1547.010/ T1547.010], 
-[https://attack.mitre.org/techniques/T1070/ T1070], 
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
-[https://attack.mitre.org/techniques/T1546.012/ T1546.012], 
-[https://attack.mitre.org/techniques/T1546.011/ T1546.011], 
-[https://attack.mitre.org/techniques/T1113/ T1113], 
-[https://attack.mitre.org/techniques/T1543/ T1543]
+[https://attack.mitre.org/techniques/T1548.002/ T1548.002]
 |
-Bypass User Account Control, 
-Masquerading, 
-Port Monitors, 
-Indicator Removal on Host, 
-Registry Run Keys / Startup Folder, 
-Image File Execution Options Injection, 
-Application Shimming, 
-Screen Capture, 
-Create or Modify System Process
+Bypass User Account Control
 |
-Privilege Escalation, Defense Evasion, 
-Defense Evasion, 
-Persistence, Privilege Escalation, 
-Defense Evasion, 
-Persistence, Privilege Escalation, 
-Privilege Escalation, Persistence, 
-Privilege Escalation, Persistence, 
-Collection, 
-Persistence, Privilege Escalation
+Privilege Escalation, Defense Evasion
 
 | TTP
 |-
@@ -6805,20 +6108,11 @@ Attackers are using Zoom as an vector to increase privileges on a sytems. This s
 | [[Documentation:ESSOC:detections:Detections#Detect_prohibited_applications_spawning_cmd_exe|Detect Prohibited Applications Spawning cmd exe]]
 
 |
-[https://attack.mitre.org/techniques/T1059.003/ T1059.003], 
-[https://attack.mitre.org/techniques/T1059/ T1059], 
-[https://attack.mitre.org/techniques/T1068/ T1068], 
-[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
+[https://attack.mitre.org/techniques/T1059.003/ T1059.003]
 |
-Windows Command Shell, 
-Command and Scripting Interpreter, 
-Exploitation for Privilege Escalation, 
-Rename System Utilities
+Windows Command Shell
 |
-Execution, 
-Execution, 
-Privilege Escalation, 
-Defense Evasion
+Execution
 
 | Hunting
 |-
@@ -7097,25 +6391,10 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of
 | [[Documentation:ESSOC:detections:Detections#Disable_registry_tool|Disable Registry Tool]]
 
 |
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
-[https://attack.mitre.org/techniques/T1564.001/ T1564.001], 
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
-[https://attack.mitre.org/techniques/T1112/ T1112], 
-[https://attack.mitre.org/techniques/T1222.001/ T1222.001], 
-[https://attack.mitre.org/techniques/T1036/ T1036]
+[https://attack.mitre.org/techniques/T1562.001/ T1562.001]
 |
-Disable or Modify Tools, 
-Hidden Files and Directories, 
-Bypass User Account Control, 
-Modify Registry, 
-Windows File and Directory Permissions Modification, 
-Masquerading
+Disable or Modify Tools
 |
-Defense Evasion, 
-Defense Evasion, 
-Privilege Escalation, Defense Evasion, 
-Defense Evasion, 
-Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -7214,35 +6493,11 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Disabling_remote_user_account_control|Disabling Remote User Account Control]]
 
 |
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
-[https://attack.mitre.org/techniques/T1036/ T1036], 
-[https://attack.mitre.org/techniques/T1547.010/ T1547.010], 
-[https://attack.mitre.org/techniques/T1070/ T1070], 
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
-[https://attack.mitre.org/techniques/T1546.012/ T1546.012], 
-[https://attack.mitre.org/techniques/T1546.011/ T1546.011], 
-[https://attack.mitre.org/techniques/T1113/ T1113], 
-[https://attack.mitre.org/techniques/T1543/ T1543]
+[https://attack.mitre.org/techniques/T1548.002/ T1548.002]
 |
-Bypass User Account Control, 
-Masquerading, 
-Port Monitors, 
-Indicator Removal on Host, 
-Registry Run Keys / Startup Folder, 
-Image File Execution Options Injection, 
-Application Shimming, 
-Screen Capture, 
-Create or Modify System Process
+Bypass User Account Control
 |
-Privilege Escalation, Defense Evasion, 
-Defense Evasion, 
-Persistence, Privilege Escalation, 
-Defense Evasion, 
-Persistence, Privilege Escalation, 
-Privilege Escalation, Persistence, 
-Privilege Escalation, Persistence, 
-Collection, 
-Persistence, Privilege Escalation
+Privilege Escalation, Defense Evasion
 
 | TTP
 |-
@@ -7472,98 +6727,14 @@ Monitors for behaviors associated with adversaries discovering objects in the en
 |
 [https://attack.mitre.org/techniques/T1078/ T1078], 
 [https://attack.mitre.org/techniques/T1087/ T1087], 
-[https://attack.mitre.org/techniques/T1484/ T1484], 
-[https://attack.mitre.org/techniques/T1199/ T1199], 
-[https://attack.mitre.org/techniques/T1482/ T1482], 
-[https://attack.mitre.org/techniques/T1590/ T1590], 
-[https://attack.mitre.org/techniques/T1591/ T1591], 
-[https://attack.mitre.org/techniques/T1595/ T1595], 
-[https://attack.mitre.org/techniques/T1592/ T1592], 
-[https://attack.mitre.org/techniques/T1007/ T1007], 
-[https://attack.mitre.org/techniques/T1012/ T1012], 
-[https://attack.mitre.org/techniques/T1046/ T1046], 
-[https://attack.mitre.org/techniques/T1047/ T1047], 
-[https://attack.mitre.org/techniques/T1057/ T1057], 
-[https://attack.mitre.org/techniques/T1083/ T1083], 
-[https://attack.mitre.org/techniques/T1518/ T1518], 
-[https://attack.mitre.org/techniques/T1592.002/ T1592.002], 
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
-[https://attack.mitre.org/techniques/T1135/ T1135], 
-[https://attack.mitre.org/techniques/T1039/ T1039], 
-[https://attack.mitre.org/techniques/T1053/ T1053], 
-[https://attack.mitre.org/techniques/T1068/ T1068], 
-[https://attack.mitre.org/techniques/T1543/ T1543], 
-[https://attack.mitre.org/techniques/T1547/ T1547], 
-[https://attack.mitre.org/techniques/T1574/ T1574], 
-[https://attack.mitre.org/techniques/T1589.001/ T1589.001], 
-[https://attack.mitre.org/techniques/T1590.001/ T1590.001], 
-[https://attack.mitre.org/techniques/T1590.003/ T1590.003], 
-[https://attack.mitre.org/techniques/T1098/ T1098], 
-[https://attack.mitre.org/techniques/T1595.002/ T1595.002], 
-[https://attack.mitre.org/techniques/T1055/ T1055]
+[https://attack.mitre.org/techniques/T1484/ T1484]
 |
 Valid Accounts, 
 Account Discovery, 
-Domain Policy Modification, 
-Trusted Relationship, 
-Domain Trust Discovery, 
-Gather Victim Network Information, 
-Gather Victim Org Information, 
-Active Scanning, 
-Gather Victim Host Information, 
-System Service Discovery, 
-Query Registry, 
-Network Service Scanning, 
-Windows Management Instrumentation, 
-Process Discovery, 
-File and Directory Discovery, 
-Software Discovery, 
-Software, 
-SMB/Windows Admin Shares, 
-Network Share Discovery, 
-Data from Network Shared Drive, 
-Scheduled Task/Job, 
-Exploitation for Privilege Escalation, 
-Create or Modify System Process, 
-Boot or Logon Autostart Execution, 
-Hijack Execution Flow, 
-Credentials, 
-Domain Properties, 
-Network Trust Dependencies, 
-Account Manipulation, 
-Vulnerability Scanning, 
-Process Injection
+Domain Policy Modification
 |
 Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
 Discovery, 
-Defense Evasion, Privilege Escalation, 
-Initial Access, 
-Discovery, 
-Reconnaissance, 
-Reconnaissance, 
-Reconnaissance, 
-Reconnaissance, 
-Discovery, 
-Discovery, 
-Discovery, 
-Execution, 
-Discovery, 
-Discovery, 
-Discovery, 
-Reconnaissance, 
-Lateral Movement, 
-Discovery, 
-Collection, 
-Execution, Persistence, Privilege Escalation, 
-Privilege Escalation, 
-Persistence, Privilege Escalation, 
-Persistence, Privilege Escalation, 
-Persistence, Privilege Escalation, Defense Evasion, 
-Reconnaissance, 
-Reconnaissance, 
-Reconnaissance, 
-Persistence, 
-Reconnaissance, 
 Defense Evasion, Privilege Escalation
 
 | TTP
@@ -7879,17 +7050,11 @@ Adversaries often try to cover their tracks by manipulating Windows logs. Use th
 | [[Documentation:ESSOC:detections:Detections#Deleting_shadow_copies|Deleting Shadow Copies]]
 
 |
-[https://attack.mitre.org/techniques/T1490/ T1490], 
-[https://attack.mitre.org/techniques/T1070/ T1070], 
-[https://attack.mitre.org/techniques/T1070.001/ T1070.001]
+[https://attack.mitre.org/techniques/T1490/ T1490]
 |
-Inhibit System Recovery, 
-Indicator Removal on Host, 
-Clear Windows Event Logs
+Inhibit System Recovery
 |
-Impact, 
-Defense Evasion, 
-Defense Evasion
+Impact
 
 | TTP
 |-
@@ -8023,59 +7188,11 @@ Monitor for activities and techniques associated with maintaining persistence on
 | [[Documentation:ESSOC:detections:Detections#Detect_path_interception_by_creation_of_program_exe|Detect Path Interception By Creation Of program exe]]
 
 |
-[https://attack.mitre.org/techniques/T1574.009/ T1574.009], 
-[https://attack.mitre.org/techniques/T1222.001/ T1222.001], 
-[https://attack.mitre.org/techniques/T1585/ T1585], 
-[https://attack.mitre.org/techniques/T1078/ T1078], 
-[https://attack.mitre.org/techniques/T1098/ T1098], 
-[https://attack.mitre.org/techniques/T1207/ T1207], 
-[https://attack.mitre.org/techniques/T1484/ T1484], 
-[https://attack.mitre.org/techniques/T1053/ T1053], 
-[https://attack.mitre.org/techniques/T1134/ T1134], 
-[https://attack.mitre.org/techniques/T1548/ T1548], 
-[https://attack.mitre.org/techniques/T1547.010/ T1547.010], 
-[https://attack.mitre.org/techniques/T1574.011/ T1574.011], 
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
-[https://attack.mitre.org/techniques/T1546.011/ T1546.011], 
-[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
-[https://attack.mitre.org/techniques/T1068/ T1068]
+[https://attack.mitre.org/techniques/T1574.009/ T1574.009]
 |
-Path Interception by Unquoted Path, 
-Windows File and Directory Permissions Modification, 
-Establish Accounts, 
-Valid Accounts, 
-Account Manipulation, 
-Rogue Domain Controller, 
-Domain Policy Modification, 
-Scheduled Task/Job, 
-Access Token Manipulation, 
-Abuse Elevation Control Mechanism, 
-Port Monitors, 
-Services Registry Permissions Weakness, 
-Registry Run Keys / Startup Folder, 
-Application Shimming, 
-Windows Service, 
-Scheduled Task, 
-Exploitation for Privilege Escalation
+Path Interception by Unquoted Path
 |
-Persistence, Privilege Escalation, Defense Evasion, 
-Defense Evasion, 
-Resource Development, 
-Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
-Persistence, 
-Defense Evasion, 
-Defense Evasion, Privilege Escalation, 
-Execution, Persistence, Privilege Escalation, 
-Defense Evasion, Privilege Escalation, 
-Privilege Escalation, Defense Evasion, 
-Persistence, Privilege Escalation, 
-Persistence, Privilege Escalation, Defense Evasion, 
-Persistence, Privilege Escalation, 
-Privilege Escalation, Persistence, 
-Persistence, Privilege Escalation, 
-Execution, Persistence, Privilege Escalation, 
-Privilege Escalation
+Persistence, Privilege Escalation, Defense Evasion
 
 | TTP
 |-
@@ -8413,29 +7530,11 @@ Monitor for and investigate activities that may be associated with a Windows pri
 | [[Documentation:ESSOC:detections:Detections#Child_processes_of_spoolsv_exe|Child Processes of Spoolsv exe]]
 
 |
-[https://attack.mitre.org/techniques/T1068/ T1068], 
-[https://attack.mitre.org/techniques/T1134/ T1134], 
-[https://attack.mitre.org/techniques/T1548/ T1548], 
-[https://attack.mitre.org/techniques/T1546.008/ T1546.008], 
-[https://attack.mitre.org/techniques/T1078/ T1078], 
-[https://attack.mitre.org/techniques/T1098/ T1098], 
-[https://attack.mitre.org/techniques/T1546.012/ T1546.012]
+[https://attack.mitre.org/techniques/T1068/ T1068]
 |
-Exploitation for Privilege Escalation, 
-Access Token Manipulation, 
-Abuse Elevation Control Mechanism, 
-Accessibility Features, 
-Valid Accounts, 
-Account Manipulation, 
-Image File Execution Options Injection
+Exploitation for Privilege Escalation
 |
-Privilege Escalation, 
-Defense Evasion, Privilege Escalation, 
-Privilege Escalation, Defense Evasion, 
-Privilege Escalation, Persistence, 
-Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
-Persistence, 
-Privilege Escalation, Persistence
+Privilege Escalation
 
 | TTP
 |-
@@ -8625,26 +7724,11 @@ Detect instances of prohibited network traffic allowed in the environment, as we
 | [[Documentation:ESSOC:detections:Detections#Allow_inbound_traffic_by_firewall_rule_registry|Allow Inbound Traffic By Firewall Rule Registry]]
 
 |
-[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
-[https://attack.mitre.org/techniques/T1189/ T1189], 
-[https://attack.mitre.org/techniques/T1021/ T1021], 
-[https://attack.mitre.org/techniques/T1048/ T1048], 
-[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
-[https://attack.mitre.org/techniques/T1071.001/ T1071.001]
+[https://attack.mitre.org/techniques/T1021.001/ T1021.001]
 |
-Remote Desktop Protocol, 
-Drive-by Compromise, 
-Remote Services, 
-Exfiltration Over Alternative Protocol, 
-Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
-Web Protocols
+Remote Desktop Protocol
 |
-Lateral Movement, 
-Initial Access, 
-Lateral Movement, 
-Exfiltration, 
-Exfiltration, 
-Command And Control
+Lateral Movement
 
 | TTP
 |-
@@ -8761,24 +7845,15 @@ Validate the security configuration of network infrastructure and verify that on
 |
 [https://attack.mitre.org/techniques/T1200/ T1200], 
 [https://attack.mitre.org/techniques/T1498/ T1498], 
-[https://attack.mitre.org/techniques/T1557.002/ T1557.002], 
-[https://attack.mitre.org/techniques/T1557/ T1557], 
-[https://attack.mitre.org/techniques/T1542.005/ T1542.005], 
-[https://attack.mitre.org/techniques/T1020.001/ T1020.001]
+[https://attack.mitre.org/techniques/T1557.002/ T1557.002]
 |
 Hardware Additions, 
 Network Denial of Service, 
-ARP Cache Poisoning, 
-Man-in-the-Middle, 
-TFTP Boot, 
-Traffic Duplication
+ARP Cache Poisoning
 |
 Initial Access, 
 Impact, 
-Credential Access, Collection, 
-Credential Access, Collection, 
-Defense Evasion, Persistence, 
-Exfiltration
+Credential Access, Collection
 
 | TTP
 |-
@@ -8967,14 +8042,11 @@ Track when a user assumes an IAM role in another AWS account to obtain cross-acc
 | [[Documentation:ESSOC:detections:Detections#Aws_detect_attach_to_role_policy|aws detect attach to role policy]]
 
 |
-[https://attack.mitre.org/techniques/T1078/ T1078], 
-[https://attack.mitre.org/techniques/T1550/ T1550]
+[https://attack.mitre.org/techniques/T1078/ T1078]
 |
-Valid Accounts, 
-Use Alternate Authentication Material
+Valid Accounts
 |
-Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
-Defense Evasion, Lateral Movement
+Defense Evasion, Persistence, Privilege Escalation, Initial Access
 
 | Hunting
 |-
@@ -9061,26 +8133,11 @@ This analytic story contains detections that query your AWS Cloudtrail for activ
 | [[Documentation:ESSOC:detections:Detections#Aws_create_policy_version_to_allow_all_resources|AWS Create Policy Version to allow all resources]]
 
 |
-[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
-[https://attack.mitre.org/techniques/T1136.003/ T1136.003], 
-[https://attack.mitre.org/techniques/T1580/ T1580], 
-[https://attack.mitre.org/techniques/T1110/ T1110], 
-[https://attack.mitre.org/techniques/T1098/ T1098], 
-[https://attack.mitre.org/techniques/T1069.003/ T1069.003]
+[https://attack.mitre.org/techniques/T1078.004/ T1078.004]
 |
-Cloud Accounts, 
-Cloud Account, 
-Cloud Infrastructure Discovery, 
-Brute Force, 
-Account Manipulation, 
-Cloud Groups
+Cloud Accounts
 |
-Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
-Persistence, 
-Discovery, 
-Credential Access, 
-Persistence, 
-Discovery
+Defense Evasion, Persistence, Privilege Escalation, Initial Access
 
 | TTP
 |-
@@ -9392,14 +8449,11 @@ Monitor your cloud compute instances for activities related to cryptojacking/cry
 | [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_instances_launched|Abnormally High Number Of Cloud Instances Launched]]
 
 |
-[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
-[https://attack.mitre.org/techniques/T1535/ T1535]
+[https://attack.mitre.org/techniques/T1078.004/ T1078.004]
 |
-Cloud Accounts, 
-Unused/Unsupported Cloud Regions
+Cloud Accounts
 |
-Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
-Defense Evasion
+Defense Evasion, Persistence, Privilege Escalation, Initial Access
 
 | Anomaly
 |-
@@ -9480,23 +8534,11 @@ This analytical story addresses events that indicate abuse of cloud federated cr
 | [[Documentation:ESSOC:detections:Detections#Aws_saml_access_by_provider_user_and_principal|AWS SAML Access by Provider User and Principal]]
 
 |
-[https://attack.mitre.org/techniques/T1078/ T1078], 
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
-[https://attack.mitre.org/techniques/T1136.003/ T1136.003], 
-[https://attack.mitre.org/techniques/T1556/ T1556], 
-[https://attack.mitre.org/techniques/T1546.012/ T1546.012]
+[https://attack.mitre.org/techniques/T1078/ T1078]
 |
-Valid Accounts, 
-LSASS Memory, 
-Cloud Account, 
-Modify Authentication Process, 
-Image File Execution Options Injection
+Valid Accounts
 |
-Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
-Credential Access, 
-Persistence, 
-Credential Access, Defense Evasion, Persistence, 
-Privilege Escalation, Persistence
+Defense Evasion, Persistence, Privilege Escalation, Initial Access
 
 | Anomaly
 |-
@@ -9687,23 +8729,11 @@ This story is focused around detecting attacks on a DevSecOps lifeccycle which c
 | [[Documentation:ESSOC:detections:Detections#Aws_ecr_container_scanning_findings_high|AWS ECR Container Scanning Findings High]]
 
 |
-[https://attack.mitre.org/techniques/T1204.003/ T1204.003], 
-[https://attack.mitre.org/techniques/T1554/ T1554], 
-[https://attack.mitre.org/techniques/T1195.001/ T1195.001], 
-[https://attack.mitre.org/techniques/T1212/ T1212], 
-[https://attack.mitre.org/techniques/T1526/ T1526]
+[https://attack.mitre.org/techniques/T1204.003/ T1204.003]
 |
-Malicious Image, 
-Compromise Client Software Binary, 
-Compromise Software Dependencies and Development Tools, 
-Exploitation for Credential Access, 
-Cloud Service Discovery
+Malicious Image
 |
-Execution, 
-Persistence, 
-Initial Access, 
-Credential Access, 
-Discovery
+Execution
 
 | TTP
 |-
@@ -10049,32 +9079,11 @@ This story is focused around detecting Office 365 Attacks.
 | [[Documentation:ESSOC:detections:Detections#High_number_of_login_failures_from_a_single_source|High Number of Login Failures from a single source]]
 
 |
-[https://attack.mitre.org/techniques/T1110.001/ T1110.001], 
-[https://attack.mitre.org/techniques/T1136.003/ T1136.003], 
-[https://attack.mitre.org/techniques/T1562.007/ T1562.007], 
-[https://attack.mitre.org/techniques/T1556/ T1556], 
-[https://attack.mitre.org/techniques/T1110/ T1110], 
-[https://attack.mitre.org/techniques/T1114/ T1114], 
-[https://attack.mitre.org/techniques/T1114.003/ T1114.003], 
-[https://attack.mitre.org/techniques/T1114.002/ T1114.002]
+[https://attack.mitre.org/techniques/T1110.001/ T1110.001]
 |
-Password Guessing, 
-Cloud Account, 
-Disable or Modify Cloud Firewall, 
-Modify Authentication Process, 
-Brute Force, 
-Email Collection, 
-Email Forwarding Rule, 
-Remote Email Collection
+Password Guessing
 |
-Credential Access, 
-Persistence, 
-Defense Evasion, 
-Credential Access, Defense Evasion, Persistence, 
-Credential Access, 
-Collection, 
-Collection, 
-Collection
+Credential Access
 
 | Anomaly
 |-
@@ -10526,28 +9535,22 @@ Monitor your cloud infrastructure provisioning activities for behaviors originat
 | [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_instances_destroyed|Abnormally High Number Of Cloud Instances Destroyed]]
 
 |
-[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
-[https://attack.mitre.org/techniques/T1537/ T1537]
+[https://attack.mitre.org/techniques/T1078.004/ T1078.004]
 |
-Cloud Accounts, 
-Transfer Data to Cloud Account
+Cloud Accounts
 |
-Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
-Exfiltration
+Defense Evasion, Persistence, Privilege Escalation, Initial Access
 
 | Anomaly
 |-
 | [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_instances_launched|Abnormally High Number Of Cloud Instances Launched]]
 
 |
-[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
-[https://attack.mitre.org/techniques/T1535/ T1535]
+[https://attack.mitre.org/techniques/T1078.004/ T1078.004]
 |
-Cloud Accounts, 
-Unused/Unsupported Cloud Regions
+Cloud Accounts
 |
-Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
-Defense Evasion
+Defense Evasion, Persistence, Privilege Escalation, Initial Access
 
 | Anomaly
 |-
@@ -10690,17 +9693,11 @@ Detect and investigate suspicious activities by users and roles in your cloud en
 | [[Documentation:ESSOC:detections:Detections#Aws_iam_accessdenied_discovery_events|AWS IAM AccessDenied Discovery Events]]
 
 |
-[https://attack.mitre.org/techniques/T1580/ T1580], 
-[https://attack.mitre.org/techniques/T1078.004/ T1078.004], 
-[https://attack.mitre.org/techniques/T1078/ T1078]
+[https://attack.mitre.org/techniques/T1580/ T1580]
 |
-Cloud Infrastructure Discovery, 
-Cloud Accounts, 
-Valid Accounts
+Cloud Infrastructure Discovery
 |
-Discovery, 
-Defense Evasion, Persistence, Privilege Escalation, Initial Access, 
-Defense Evasion, Persistence, Privilege Escalation, Initial Access
+Discovery
 
 | Anomaly
 |-
@@ -10845,17 +9842,11 @@ The following analytic story identifies behaviors related PrintNightmare, or CVE
 | [[Documentation:ESSOC:detections:Detections#Print_spooler_adding_a_printer_driver|Print Spooler Adding A Printer Driver]]
 
 |
-[https://attack.mitre.org/techniques/T1547.012/ T1547.012], 
-[https://attack.mitre.org/techniques/T1218.011/ T1218.011], 
-[https://attack.mitre.org/techniques/T1068/ T1068]
+[https://attack.mitre.org/techniques/T1547.012/ T1547.012]
 |
-Print Processors, 
-Rundll32, 
-Exploitation for Privilege Escalation
+Print Processors
 |
-Persistence, Privilege Escalation, 
-Defense Evasion, 
-Privilege Escalation
+Persistence, Privilege Escalation
 
 | TTP
 |-
@@ -10999,20 +9990,11 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | [[Documentation:ESSOC:detections:Detections#Add_defaultuser_and_password_in_registry|Add DefaultUser And Password In Registry]]
 
 |
-[https://attack.mitre.org/techniques/T1552.002/ T1552.002], 
-[https://attack.mitre.org/techniques/T1490/ T1490], 
-[https://attack.mitre.org/techniques/T1491/ T1491], 
-[https://attack.mitre.org/techniques/T1486/ T1486]
+[https://attack.mitre.org/techniques/T1552.002/ T1552.002]
 |
-Credentials in Registry, 
-Inhibit System Recovery, 
-Defacement, 
-Data Encrypted for Impact
+Credentials in Registry
 |
-Credential Access, 
-Impact, 
-Impact, 
-Impact
+Credential Access
 
 | Anomaly
 |-
@@ -11127,35 +10109,11 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | [[Documentation:ESSOC:detections:Detections#Clop_common_exec_parameter|Clop Common Exec Parameter]]
 
 |
-[https://attack.mitre.org/techniques/T1204/ T1204], 
-[https://attack.mitre.org/techniques/T1543/ T1543], 
-[https://attack.mitre.org/techniques/T1485/ T1485], 
-[https://attack.mitre.org/techniques/T1569.002/ T1569.002], 
-[https://attack.mitre.org/techniques/T1490/ T1490], 
-[https://attack.mitre.org/techniques/T1486/ T1486], 
-[https://attack.mitre.org/techniques/T1070/ T1070], 
-[https://attack.mitre.org/techniques/T1489/ T1489], 
-[https://attack.mitre.org/techniques/T1070.001/ T1070.001]
+[https://attack.mitre.org/techniques/T1204/ T1204]
 |
-User Execution, 
-Create or Modify System Process, 
-Data Destruction, 
-Service Execution, 
-Inhibit System Recovery, 
-Data Encrypted for Impact, 
-Indicator Removal on Host, 
-Service Stop, 
-Clear Windows Event Logs
+User Execution
 |
-Execution, 
-Persistence, Privilege Escalation, 
-Impact, 
-Execution, 
-Impact, 
-Impact, 
-Defense Evasion, 
-Impact, 
-Defense Evasion
+Execution
 
 | TTP
 |-
@@ -11206,17 +10164,11 @@ Execution
 | [[Documentation:ESSOC:detections:Detections#Deleting_shadow_copies|Deleting Shadow Copies]]
 
 |
-[https://attack.mitre.org/techniques/T1490/ T1490], 
-[https://attack.mitre.org/techniques/T1070/ T1070], 
-[https://attack.mitre.org/techniques/T1070.001/ T1070.001]
+[https://attack.mitre.org/techniques/T1490/ T1490]
 |
-Inhibit System Recovery, 
-Indicator Removal on Host, 
-Clear Windows Event Logs
+Inhibit System Recovery
 |
-Impact, 
-Defense Evasion, 
-Defense Evasion
+Impact
 
 | TTP
 |-
@@ -11427,41 +10379,11 @@ Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA
 | [[Documentation:ESSOC:detections:Detections#Create_local_admin_accounts_using_net_exe|Create local admin accounts using net exe]]
 
 |
-[https://attack.mitre.org/techniques/T1136.001/ T1136.001], 
-[https://attack.mitre.org/techniques/T1071.002/ T1071.002], 
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
-[https://attack.mitre.org/techniques/T1569.002/ T1569.002], 
-[https://attack.mitre.org/techniques/T1059.001/ T1059.001], 
-[https://attack.mitre.org/techniques/T1562.004/ T1562.004], 
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
-[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
-[https://attack.mitre.org/techniques/T1204.002/ T1204.002], 
-[https://attack.mitre.org/techniques/T1112/ T1112]
+[https://attack.mitre.org/techniques/T1136.001/ T1136.001]
 |
-Local Account, 
-File Transfer Protocols, 
-SMB/Windows Admin Shares, 
-Service Execution, 
-PowerShell, 
-Disable or Modify System Firewall, 
-Registry Run Keys / Startup Folder, 
-Windows Service, 
-Scheduled Task, 
-Malicious File, 
-Modify Registry
+Local Account
 |
-Persistence, 
-Command And Control, 
-Lateral Movement, 
-Execution, 
-Execution, 
-Defense Evasion, 
-Persistence, Privilege Escalation, 
-Persistence, Privilege Escalation, 
-Execution, Persistence, Privilege Escalation, 
-Execution, 
-Defense Evasion
+Persistence
 
 | TTP
 |-
@@ -11657,44 +10579,11 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | [[Documentation:ESSOC:detections:Detections#Attempted_credential_dump_from_registry_via_reg_exe|Attempted Credential Dump From Registry via Reg exe]]
 
 |
-[https://attack.mitre.org/techniques/T1003.002/ T1003.002], 
-[https://attack.mitre.org/techniques/T1197/ T1197], 
-[https://attack.mitre.org/techniques/T1105/ T1105], 
-[https://attack.mitre.org/techniques/T1218.003/ T1218.003], 
-[https://attack.mitre.org/techniques/T1055/ T1055], 
-[https://attack.mitre.org/techniques/T1490/ T1490], 
-[https://attack.mitre.org/techniques/T1003.001/ T1003.001], 
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
-[https://attack.mitre.org/techniques/T1020/ T1020], 
-[https://attack.mitre.org/techniques/T1569.002/ T1569.002], 
-[https://attack.mitre.org/techniques/T1486/ T1486], 
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002]
+[https://attack.mitre.org/techniques/T1003.002/ T1003.002]
 |
-Security Account Manager, 
-BITS Jobs, 
-Ingress Tool Transfer, 
-CMSTP, 
-Process Injection, 
-Inhibit System Recovery, 
-LSASS Memory, 
-SMB/Windows Admin Shares, 
-Automated Exfiltration, 
-Service Execution, 
-Data Encrypted for Impact, 
-Bypass User Account Control
+Security Account Manager
 |
-Credential Access, 
-Defense Evasion, Persistence, 
-Command And Control, 
-Defense Evasion, 
-Defense Evasion, Privilege Escalation, 
-Impact, 
-Credential Access, 
-Lateral Movement, 
-Exfiltration, 
-Execution, 
-Impact, 
-Privilege Escalation, Defense Evasion
+Credential Access
 
 | TTP
 |-
@@ -11917,41 +10806,11 @@ Detect and investigate hosts in your environment that may be communicating with
 | [[Documentation:ESSOC:detections:Detections#Dns_exfiltration_using_nslookup_app|DNS Exfiltration Using Nslookup App]]
 
 |
-[https://attack.mitre.org/techniques/T1048/ T1048], 
-[https://attack.mitre.org/techniques/T1071.004/ T1071.004], 
-[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
-[https://attack.mitre.org/techniques/T1095/ T1095], 
-[https://attack.mitre.org/techniques/T1041/ T1041], 
-[https://attack.mitre.org/techniques/T1189/ T1189], 
-[https://attack.mitre.org/techniques/T1537/ T1537], 
-[https://attack.mitre.org/techniques/T1114.001/ T1114.001], 
-[https://attack.mitre.org/techniques/T1114/ T1114], 
-[https://attack.mitre.org/techniques/T1114.003/ T1114.003], 
-[https://attack.mitre.org/techniques/T1071.001/ T1071.001]
+[https://attack.mitre.org/techniques/T1048/ T1048]
 |
-Exfiltration Over Alternative Protocol, 
-DNS, 
-Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
-Non-Application Layer Protocol, 
-Exfiltration Over C2 Channel, 
-Drive-by Compromise, 
-Transfer Data to Cloud Account, 
-Local Email Collection, 
-Email Collection, 
-Email Forwarding Rule, 
-Web Protocols
+Exfiltration Over Alternative Protocol
 |
-Exfiltration, 
-Command And Control, 
-Exfiltration, 
-Command And Control, 
-Exfiltration, 
-Initial Access, 
-Exfiltration, 
-Collection, 
-Collection, 
-Collection, 
-Command And Control
+Exfiltration
 
 | TTP
 |-
@@ -12034,23 +10893,11 @@ Detect rarely used executables, specific registry paths that may confer malware
 | [[Documentation:ESSOC:detections:Detections#Detect_use_of_cmd_exe_to_launch_script_interpreters|Detect Use of cmd exe to Launch Script Interpreters]]
 
 |
-[https://attack.mitre.org/techniques/T1059.003/ T1059.003], 
-[https://attack.mitre.org/techniques/T1072/ T1072], 
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
-[https://attack.mitre.org/techniques/T1566.001/ T1566.001]
+[https://attack.mitre.org/techniques/T1059.003/ T1059.003]
 |
-Windows Command Shell, 
-Software Deployment Tools, 
-Registry Run Keys / Startup Folder, 
-SMB/Windows Admin Shares, 
-Spearphishing Attachment
+Windows Command Shell
 |
-Execution, 
-Execution, Lateral Movement, 
-Persistence, Privilege Escalation, 
-Lateral Movement, 
-Initial Access
+Execution
 
 | TTP
 |-
@@ -12168,23 +11015,11 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | [[Documentation:ESSOC:detections:Detections#Check_elevated_cmd_using_whoami|Check Elevated CMD using whoami]]
 
 |
-[https://attack.mitre.org/techniques/T1033/ T1033], 
-[https://attack.mitre.org/techniques/T1059.007/ T1059.007], 
-[https://attack.mitre.org/techniques/T1555.003/ T1555.003], 
-[https://attack.mitre.org/techniques/T1566.001/ T1566.001], 
-[https://attack.mitre.org/techniques/T1220/ T1220]
+[https://attack.mitre.org/techniques/T1033/ T1033]
 |
-System Owner/User Discovery, 
-JavaScript, 
-Credentials from Web Browsers, 
-Spearphishing Attachment, 
-XSL Script Processing
+System Owner/User Discovery
 |
-Discovery, 
-Execution, 
-Credential Access, 
-Initial Access, 
-Defense Evasion
+Discovery
 
 | TTP
 |-
@@ -12330,26 +11165,11 @@ Monitor for and investigate activities, including the creation or deletion of hi
 | [[Documentation:ESSOC:detections:Detections#Create_or_delete_windows_shares_using_net_exe|Create or delete windows shares using net exe]]
 
 |
-[https://attack.mitre.org/techniques/T1070.005/ T1070.005], 
-[https://attack.mitre.org/techniques/T1071.004/ T1071.004], 
-[https://attack.mitre.org/techniques/T1048.003/ T1048.003], 
-[https://attack.mitre.org/techniques/T1071.002/ T1071.002], 
-[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
+[https://attack.mitre.org/techniques/T1070.005/ T1070.005]
 |
-Network Share Connection Removal, 
-DNS, 
-Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, 
-File Transfer Protocols, 
-Remote Desktop Protocol, 
-SMB/Windows Admin Shares
+Network Share Connection Removal
 |
-Defense Evasion, 
-Command And Control, 
-Exfiltration, 
-Command And Control, 
-Lateral Movement, 
-Lateral Movement
+Defense Evasion
 
 | TTP
 |-
@@ -12473,68 +11293,11 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | [[Documentation:ESSOC:detections:Detections#Account_discovery_with_net_app|Account Discovery With Net App]]
 
 |
-[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
-[https://attack.mitre.org/techniques/T1059/ T1059], 
-[https://attack.mitre.org/techniques/T1055/ T1055], 
-[https://attack.mitre.org/techniques/T1204.002/ T1204.002], 
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
-[https://attack.mitre.org/techniques/T1112/ T1112], 
-[https://attack.mitre.org/techniques/T1560.001/ T1560.001], 
-[https://attack.mitre.org/techniques/T1218.005/ T1218.005], 
-[https://attack.mitre.org/techniques/T1482/ T1482], 
-[https://attack.mitre.org/techniques/T1566.001/ T1566.001], 
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
-[https://attack.mitre.org/techniques/T1218.011/ T1218.011], 
-[https://attack.mitre.org/techniques/T1053/ T1053], 
-[https://attack.mitre.org/techniques/T1005/ T1005], 
-[https://attack.mitre.org/techniques/T1218.010/ T1218.010], 
-[https://attack.mitre.org/techniques/T1590.005/ T1590.005], 
-[https://attack.mitre.org/techniques/T1027/ T1027], 
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
+[https://attack.mitre.org/techniques/T1087.002/ T1087.002]
 |
-Domain Account, 
-Disable or Modify Tools, 
-Command and Scripting Interpreter, 
-Process Injection, 
-Malicious File, 
-Bypass User Account Control, 
-Modify Registry, 
-Archive via Utility, 
-Mshta, 
-Domain Trust Discovery, 
-Spearphishing Attachment, 
-Registry Run Keys / Startup Folder, 
-Rundll32, 
-Scheduled Task/Job, 
-Data from Local System, 
-Regsvr32, 
-IP Addresses, 
-Obfuscated Files or Information, 
-Scheduled Task, 
-SMB/Windows Admin Shares
+Domain Account
 |
-Discovery, 
-Defense Evasion, 
-Execution, 
-Defense Evasion, Privilege Escalation, 
-Execution, 
-Privilege Escalation, Defense Evasion, 
-Defense Evasion, 
-Collection, 
-Defense Evasion, 
-Discovery, 
-Initial Access, 
-Persistence, Privilege Escalation, 
-Defense Evasion, 
-Execution, Persistence, Privilege Escalation, 
-Collection, 
-Defense Evasion, 
-Reconnaissance, 
-Defense Evasion, 
-Execution, Persistence, Privilege Escalation, 
-Lateral Movement
+Discovery
 
 | TTP
 |-
@@ -12841,26 +11604,11 @@ Detect activities and various techniques associated with the Orangeworm Attack G
 | [[Documentation:ESSOC:detections:Detections#First_time_seen_running_windows_service|First Time Seen Running Windows Service]]
 
 |
-[https://attack.mitre.org/techniques/T1569.002/ T1569.002], 
-[https://attack.mitre.org/techniques/T1055/ T1055], 
-[https://attack.mitre.org/techniques/T1106/ T1106], 
-[https://attack.mitre.org/techniques/T1569/ T1569], 
-[https://attack.mitre.org/techniques/T1574.011/ T1574.011], 
-[https://attack.mitre.org/techniques/T1543.003/ T1543.003]
+[https://attack.mitre.org/techniques/T1569.002/ T1569.002]
 |
-Service Execution, 
-Process Injection, 
-Native API, 
-System Services, 
-Services Registry Permissions Weakness, 
-Windows Service
+Service Execution
 |
-Execution, 
-Defense Evasion, Privilege Escalation, 
-Execution, 
-Execution, 
-Persistence, Privilege Escalation, Defense Evasion, 
-Persistence, Privilege Escalation
+Execution
 
 | Anomaly
 |-
@@ -12918,116 +11666,11 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | [[Documentation:ESSOC:detections:Detections#7zip_commandline_to_smb_share_path|7zip CommandLine To SMB Share Path]]
 
 |
-[https://attack.mitre.org/techniques/T1560.001/ T1560.001], 
-[https://attack.mitre.org/techniques/T1562.007/ T1562.007], 
-[https://attack.mitre.org/techniques/T1548/ T1548], 
-[https://attack.mitre.org/techniques/T1489/ T1489], 
-[https://attack.mitre.org/techniques/T1490/ T1490], 
-[https://attack.mitre.org/techniques/T1218.003/ T1218.003], 
-[https://attack.mitre.org/techniques/T1070.004/ T1070.004], 
-[https://attack.mitre.org/techniques/T1485/ T1485], 
-[https://attack.mitre.org/techniques/T1204/ T1204], 
-[https://attack.mitre.org/techniques/T1020/ T1020], 
-[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
-[https://attack.mitre.org/techniques/T1087.001/ T1087.001], 
-[https://attack.mitre.org/techniques/T1482/ T1482], 
-[https://attack.mitre.org/techniques/T1069.002/ T1069.002], 
-[https://attack.mitre.org/techniques/T1069.001/ T1069.001], 
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
-[https://attack.mitre.org/techniques/T1070.001/ T1070.001], 
-[https://attack.mitre.org/techniques/T1531/ T1531], 
-[https://attack.mitre.org/techniques/T1569.002/ T1569.002], 
-[https://attack.mitre.org/techniques/T1059.005/ T1059.005], 
-[https://attack.mitre.org/techniques/T1070/ T1070], 
-[https://attack.mitre.org/techniques/T1222/ T1222], 
-[https://attack.mitre.org/techniques/T1491/ T1491], 
-[https://attack.mitre.org/techniques/T1574.002/ T1574.002], 
-[https://attack.mitre.org/techniques/T1027.005/ T1027.005], 
-[https://attack.mitre.org/techniques/T1546.015/ T1546.015], 
-[https://attack.mitre.org/techniques/T1048/ T1048], 
-[https://attack.mitre.org/techniques/T1592/ T1592], 
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
-[https://attack.mitre.org/techniques/T1047/ T1047], 
-[https://attack.mitre.org/techniques/T1112/ T1112], 
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
-[https://attack.mitre.org/techniques/T1036.003/ T1036.003], 
-[https://attack.mitre.org/techniques/T1071.001/ T1071.001], 
-[https://attack.mitre.org/techniques/T1218.007/ T1218.007]
+[https://attack.mitre.org/techniques/T1560.001/ T1560.001]
 |
-Archive via Utility, 
-Disable or Modify Cloud Firewall, 
-Abuse Elevation Control Mechanism, 
-Service Stop, 
-Inhibit System Recovery, 
-CMSTP, 
-File Deletion, 
-Data Destruction, 
-User Execution, 
-Automated Exfiltration, 
-Domain Account, 
-Local Account, 
-Domain Trust Discovery, 
-Domain Groups, 
-Local Groups, 
-Disable or Modify Tools, 
-Clear Windows Event Logs, 
-Account Access Removal, 
-Service Execution, 
-Visual Basic, 
-Indicator Removal on Host, 
-File and Directory Permissions Modification, 
-Defacement, 
-DLL Side-Loading, 
-Indicator Removal from Tools, 
-Component Object Model Hijacking, 
-Exfiltration Over Alternative Protocol, 
-Gather Victim Host Information, 
-Registry Run Keys / Startup Folder, 
-Windows Management Instrumentation, 
-Modify Registry, 
-SMB/Windows Admin Shares, 
-Scheduled Task, 
-Rename System Utilities, 
-Web Protocols, 
-Msiexec
+Archive via Utility
 |
-Collection, 
-Defense Evasion, 
-Privilege Escalation, Defense Evasion, 
-Impact, 
-Impact, 
-Defense Evasion, 
-Defense Evasion, 
-Impact, 
-Execution, 
-Exfiltration, 
-Discovery, 
-Discovery, 
-Discovery, 
-Discovery, 
-Discovery, 
-Defense Evasion, 
-Defense Evasion, 
-Impact, 
-Execution, 
-Execution, 
-Defense Evasion, 
-Defense Evasion, 
-Impact, 
-Persistence, Privilege Escalation, Defense Evasion, 
-Defense Evasion, 
-Privilege Escalation, Persistence, 
-Exfiltration, 
-Reconnaissance, 
-Persistence, Privilege Escalation, 
-Execution, 
-Defense Evasion, 
-Lateral Movement, 
-Execution, Persistence, Privilege Escalation, 
-Defense Evasion, 
-Command And Control, 
-Defense Evasion
+Collection
 
 | Hunting
 |-
@@ -13045,31 +11688,10 @@ Defense Evasion
 | [[Documentation:ESSOC:detections:Detections#Allow_network_discovery_in_firewall|Allow Network Discovery In Firewall]]
 
 |
-[https://attack.mitre.org/techniques/T1562.007/ T1562.007], 
-[https://attack.mitre.org/techniques/T1490/ T1490], 
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
-[https://attack.mitre.org/techniques/T1491/ T1491], 
-[https://attack.mitre.org/techniques/T1574.002/ T1574.002], 
-[https://attack.mitre.org/techniques/T1204/ T1204], 
-[https://attack.mitre.org/techniques/T1112/ T1112], 
-[https://attack.mitre.org/techniques/T1218.003/ T1218.003]
+[https://attack.mitre.org/techniques/T1562.007/ T1562.007]
 |
-Disable or Modify Cloud Firewall, 
-Inhibit System Recovery, 
-Disable or Modify Tools, 
-Defacement, 
-DLL Side-Loading, 
-User Execution, 
-Modify Registry, 
-CMSTP
+Disable or Modify Cloud Firewall
 |
-Defense Evasion, 
-Impact, 
-Defense Evasion, 
-Impact, 
-Persistence, Privilege Escalation, Defense Evasion, 
-Execution, 
-Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -13110,34 +11732,10 @@ Impact
 | [[Documentation:ESSOC:detections:Detections#Bcdedit_failure_recovery_modification|BCDEdit Failure Recovery Modification]]
 
 |
-[https://attack.mitre.org/techniques/T1490/ T1490], 
-[https://attack.mitre.org/techniques/T1485/ T1485], 
-[https://attack.mitre.org/techniques/T1482/ T1482], 
-[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
-[https://attack.mitre.org/techniques/T1486/ T1486], 
-[https://attack.mitre.org/techniques/T1059.003/ T1059.003], 
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
-[https://attack.mitre.org/techniques/T1489/ T1489]
+[https://attack.mitre.org/techniques/T1490/ T1490]
 |
-Inhibit System Recovery, 
-Data Destruction, 
-Domain Trust Discovery, 
-Remote Desktop Protocol, 
-Data Encrypted for Impact, 
-Windows Command Shell, 
-Scheduled Task, 
-Disable or Modify Tools, 
-Service Stop
+Inhibit System Recovery
 |
-Impact, 
-Impact, 
-Discovery, 
-Lateral Movement, 
-Impact, 
-Execution, 
-Execution, Persistence, Privilege Escalation, 
-Defense Evasion, 
 Impact
 
 | TTP
@@ -13222,17 +11820,11 @@ Impact
 | [[Documentation:ESSOC:detections:Detections#Deleting_shadow_copies|Deleting Shadow Copies]]
 
 |
-[https://attack.mitre.org/techniques/T1490/ T1490], 
-[https://attack.mitre.org/techniques/T1070/ T1070], 
-[https://attack.mitre.org/techniques/T1070.001/ T1070.001]
+[https://attack.mitre.org/techniques/T1490/ T1490]
 |
-Inhibit System Recovery, 
-Indicator Removal on Host, 
-Clear Windows Event Logs
+Inhibit System Recovery
 |
-Impact, 
-Defense Evasion, 
-Defense Evasion
+Impact
 
 | TTP
 |-
@@ -13970,35 +12562,11 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | [[Documentation:ESSOC:detections:Detections#Disabling_remote_user_account_control|Disabling Remote User Account Control]]
 
 |
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
-[https://attack.mitre.org/techniques/T1036/ T1036], 
-[https://attack.mitre.org/techniques/T1547.010/ T1547.010], 
-[https://attack.mitre.org/techniques/T1070/ T1070], 
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
-[https://attack.mitre.org/techniques/T1546.012/ T1546.012], 
-[https://attack.mitre.org/techniques/T1546.011/ T1546.011], 
-[https://attack.mitre.org/techniques/T1113/ T1113], 
-[https://attack.mitre.org/techniques/T1543/ T1543]
+[https://attack.mitre.org/techniques/T1548.002/ T1548.002]
 |
-Bypass User Account Control, 
-Masquerading, 
-Port Monitors, 
-Indicator Removal on Host, 
-Registry Run Keys / Startup Folder, 
-Image File Execution Options Injection, 
-Application Shimming, 
-Screen Capture, 
-Create or Modify System Process
+Bypass User Account Control
 |
-Privilege Escalation, Defense Evasion, 
-Defense Evasion, 
-Persistence, Privilege Escalation, 
-Defense Evasion, 
-Persistence, Privilege Escalation, 
-Privilege Escalation, Persistence, 
-Privilege Escalation, Persistence, 
-Collection, 
-Persistence, Privilege Escalation
+Privilege Escalation, Defense Evasion
 
 | TTP
 |-
@@ -14044,6 +12612,17 @@ Screen Capture
 |
 Collection
 
+| TTP
+|-
+| [[Documentation:ESSOC:detections:Detections#Remcos_client_registry_install_entry|Remcos client registry install entry]]
+
+|
+[https://attack.mitre.org/techniques/T1112/ T1112]
+|
+Modify Registry
+|
+Defense Evasion
+
 | TTP
 |-
 | [[Documentation:ESSOC:detections:Detections#Suspicious_image_creation_in_appdata_folder|Suspicious Image Creation In Appdata Folder]]
@@ -14124,31 +12703,10 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | [[Documentation:ESSOC:detections:Detections#Allow_network_discovery_in_firewall|Allow Network Discovery In Firewall]]
 
 |
-[https://attack.mitre.org/techniques/T1562.007/ T1562.007], 
-[https://attack.mitre.org/techniques/T1490/ T1490], 
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
-[https://attack.mitre.org/techniques/T1491/ T1491], 
-[https://attack.mitre.org/techniques/T1574.002/ T1574.002], 
-[https://attack.mitre.org/techniques/T1204/ T1204], 
-[https://attack.mitre.org/techniques/T1112/ T1112], 
-[https://attack.mitre.org/techniques/T1218.003/ T1218.003]
+[https://attack.mitre.org/techniques/T1562.007/ T1562.007]
 |
-Disable or Modify Cloud Firewall, 
-Inhibit System Recovery, 
-Disable or Modify Tools, 
-Defacement, 
-DLL Side-Loading, 
-User Execution, 
-Modify Registry, 
-CMSTP
+Disable or Modify Cloud Firewall
 |
-Defense Evasion, 
-Impact, 
-Defense Evasion, 
-Impact, 
-Persistence, Privilege Escalation, Defense Evasion, 
-Execution, 
-Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -14282,34 +12840,10 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | [[Documentation:ESSOC:detections:Detections#Bcdedit_failure_recovery_modification|BCDEdit Failure Recovery Modification]]
 
 |
-[https://attack.mitre.org/techniques/T1490/ T1490], 
-[https://attack.mitre.org/techniques/T1485/ T1485], 
-[https://attack.mitre.org/techniques/T1482/ T1482], 
-[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
-[https://attack.mitre.org/techniques/T1486/ T1486], 
-[https://attack.mitre.org/techniques/T1059.003/ T1059.003], 
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
-[https://attack.mitre.org/techniques/T1489/ T1489]
+[https://attack.mitre.org/techniques/T1490/ T1490]
 |
-Inhibit System Recovery, 
-Data Destruction, 
-Domain Trust Discovery, 
-Remote Desktop Protocol, 
-Data Encrypted for Impact, 
-Windows Command Shell, 
-Scheduled Task, 
-Disable or Modify Tools, 
-Service Stop
+Inhibit System Recovery
 |
-Impact, 
-Impact, 
-Discovery, 
-Lateral Movement, 
-Impact, 
-Execution, 
-Execution, Persistence, Privilege Escalation, 
-Defense Evasion, 
 Impact
 
 | TTP
@@ -14520,96 +13054,15 @@ Leverage searches that allow you to detect and investigate unusual activities th
 |
 [https://attack.mitre.org/techniques/T1036.005/ T1036.005], 
 [https://attack.mitre.org/techniques/T1595/ T1595], 
-[https://attack.mitre.org/techniques/T1003/ T1003], 
-[https://attack.mitre.org/techniques/T1489/ T1489], 
-[https://attack.mitre.org/techniques/T1204.002/ T1204.002], 
-[https://attack.mitre.org/techniques/T1485/ T1485], 
-[https://attack.mitre.org/techniques/T1531/ T1531], 
-[https://attack.mitre.org/techniques/T1490/ T1490], 
-[https://attack.mitre.org/techniques/T1222/ T1222], 
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
-[https://attack.mitre.org/techniques/T1569.002/ T1569.002], 
-[https://attack.mitre.org/techniques/T1082/ T1082], 
-[https://attack.mitre.org/techniques/T1016/ T1016], 
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
-[https://attack.mitre.org/techniques/T1105/ T1105], 
-[https://attack.mitre.org/techniques/T1087/ T1087], 
-[https://attack.mitre.org/techniques/T1036/ T1036], 
-[https://attack.mitre.org/techniques/T1059/ T1059], 
-[https://attack.mitre.org/techniques/T1117/ T1117], 
-[https://attack.mitre.org/techniques/T1202/ T1202], 
-[https://attack.mitre.org/techniques/T1053/ T1053], 
-[https://attack.mitre.org/techniques/T1203/ T1203], 
-[https://attack.mitre.org/techniques/T1072/ T1072], 
-[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
-[https://attack.mitre.org/techniques/T1218.011/ T1218.011], 
-[https://attack.mitre.org/techniques/T1486/ T1486], 
-[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
-[https://attack.mitre.org/techniques/T1543/ T1543], 
-[https://attack.mitre.org/techniques/T1036.003/ T1036.003], 
-[https://attack.mitre.org/techniques/T1190/ T1190]
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
 Match Legitimate Name or Location, 
 Active Scanning, 
-OS Credential Dumping, 
-Service Stop, 
-Malicious File, 
-Data Destruction, 
-Account Access Removal, 
-Inhibit System Recovery, 
-File and Directory Permissions Modification, 
-SMB/Windows Admin Shares, 
-Service Execution, 
-System Information Discovery, 
-System Network Configuration Discovery, 
-Disable or Modify Tools, 
-Ingress Tool Transfer, 
-Account Discovery, 
-Masquerading, 
-Command and Scripting Interpreter, 
-Regsvr32, 
-Indirect Command Execution, 
-Scheduled Task/Job, 
-Exploitation for Client Execution, 
-Software Deployment Tools, 
-Remote Desktop Protocol, 
-Rundll32, 
-Data Encrypted for Impact, 
-Windows Service, 
-Create or Modify System Process, 
-Rename System Utilities, 
-Exploit Public-Facing Application
+OS Credential Dumping
 |
 Defense Evasion, 
 Reconnaissance, 
-Credential Access, 
-Impact, 
-Execution, 
-Impact, 
-Impact, 
-Impact, 
-Defense Evasion, 
-Lateral Movement, 
-Execution, 
-Discovery, 
-Discovery, 
-Defense Evasion, 
-Command And Control, 
-Discovery, 
-Defense Evasion, 
-Execution, 
-, 
-Defense Evasion, 
-Execution, Persistence, Privilege Escalation, 
-Execution, 
-Execution, Lateral Movement, 
-Lateral Movement, 
-Defense Evasion, 
-Impact, 
-Persistence, Privilege Escalation, 
-Persistence, Privilege Escalation, 
-Defense Evasion, 
-Initial Access
+Credential Access
 
 | TTP
 |-
@@ -14649,17 +13102,11 @@ Impact
 | [[Documentation:ESSOC:detections:Detections#Deleting_shadow_copies|Deleting Shadow Copies]]
 
 |
-[https://attack.mitre.org/techniques/T1490/ T1490], 
-[https://attack.mitre.org/techniques/T1070/ T1070], 
-[https://attack.mitre.org/techniques/T1070.001/ T1070.001]
+[https://attack.mitre.org/techniques/T1490/ T1490]
 |
-Inhibit System Recovery, 
-Indicator Removal on Host, 
-Clear Windows Event Logs
+Inhibit System Recovery
 |
-Impact, 
-Defense Evasion, 
-Defense Evasion
+Impact
 
 | TTP
 |-
@@ -14810,68 +13257,11 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | [[Documentation:ESSOC:detections:Detections#Account_discovery_with_net_app|Account Discovery With Net App]]
 
 |
-[https://attack.mitre.org/techniques/T1087.002/ T1087.002], 
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
-[https://attack.mitre.org/techniques/T1059/ T1059], 
-[https://attack.mitre.org/techniques/T1055/ T1055], 
-[https://attack.mitre.org/techniques/T1204.002/ T1204.002], 
-[https://attack.mitre.org/techniques/T1548.002/ T1548.002], 
-[https://attack.mitre.org/techniques/T1112/ T1112], 
-[https://attack.mitre.org/techniques/T1560.001/ T1560.001], 
-[https://attack.mitre.org/techniques/T1218.005/ T1218.005], 
-[https://attack.mitre.org/techniques/T1482/ T1482], 
-[https://attack.mitre.org/techniques/T1566.001/ T1566.001], 
-[https://attack.mitre.org/techniques/T1547.001/ T1547.001], 
-[https://attack.mitre.org/techniques/T1218.011/ T1218.011], 
-[https://attack.mitre.org/techniques/T1053/ T1053], 
-[https://attack.mitre.org/techniques/T1005/ T1005], 
-[https://attack.mitre.org/techniques/T1218.010/ T1218.010], 
-[https://attack.mitre.org/techniques/T1590.005/ T1590.005], 
-[https://attack.mitre.org/techniques/T1027/ T1027], 
-[https://attack.mitre.org/techniques/T1053.005/ T1053.005], 
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002]
+[https://attack.mitre.org/techniques/T1087.002/ T1087.002]
 |
-Domain Account, 
-Disable or Modify Tools, 
-Command and Scripting Interpreter, 
-Process Injection, 
-Malicious File, 
-Bypass User Account Control, 
-Modify Registry, 
-Archive via Utility, 
-Mshta, 
-Domain Trust Discovery, 
-Spearphishing Attachment, 
-Registry Run Keys / Startup Folder, 
-Rundll32, 
-Scheduled Task/Job, 
-Data from Local System, 
-Regsvr32, 
-IP Addresses, 
-Obfuscated Files or Information, 
-Scheduled Task, 
-SMB/Windows Admin Shares
+Domain Account
 |
-Discovery, 
-Defense Evasion, 
-Execution, 
-Defense Evasion, Privilege Escalation, 
-Execution, 
-Privilege Escalation, Defense Evasion, 
-Defense Evasion, 
-Collection, 
-Defense Evasion, 
-Discovery, 
-Initial Access, 
-Persistence, Privilege Escalation, 
-Defense Evasion, 
-Execution, Persistence, Privilege Escalation, 
-Collection, 
-Defense Evasion, 
-Reconnaissance, 
-Defense Evasion, 
-Execution, Persistence, Privilege Escalation, 
-Lateral Movement
+Discovery
 
 | TTP
 |-
@@ -15080,96 +13470,15 @@ Quickly identify systems running new or unusual processes in your environment th
 |
 [https://attack.mitre.org/techniques/T1036.005/ T1036.005], 
 [https://attack.mitre.org/techniques/T1595/ T1595], 
-[https://attack.mitre.org/techniques/T1003/ T1003], 
-[https://attack.mitre.org/techniques/T1489/ T1489], 
-[https://attack.mitre.org/techniques/T1204.002/ T1204.002], 
-[https://attack.mitre.org/techniques/T1485/ T1485], 
-[https://attack.mitre.org/techniques/T1531/ T1531], 
-[https://attack.mitre.org/techniques/T1490/ T1490], 
-[https://attack.mitre.org/techniques/T1222/ T1222], 
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
-[https://attack.mitre.org/techniques/T1569.002/ T1569.002], 
-[https://attack.mitre.org/techniques/T1082/ T1082], 
-[https://attack.mitre.org/techniques/T1016/ T1016], 
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
-[https://attack.mitre.org/techniques/T1105/ T1105], 
-[https://attack.mitre.org/techniques/T1087/ T1087], 
-[https://attack.mitre.org/techniques/T1036/ T1036], 
-[https://attack.mitre.org/techniques/T1059/ T1059], 
-[https://attack.mitre.org/techniques/T1117/ T1117], 
-[https://attack.mitre.org/techniques/T1202/ T1202], 
-[https://attack.mitre.org/techniques/T1053/ T1053], 
-[https://attack.mitre.org/techniques/T1203/ T1203], 
-[https://attack.mitre.org/techniques/T1072/ T1072], 
-[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
-[https://attack.mitre.org/techniques/T1218.011/ T1218.011], 
-[https://attack.mitre.org/techniques/T1486/ T1486], 
-[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
-[https://attack.mitre.org/techniques/T1543/ T1543], 
-[https://attack.mitre.org/techniques/T1036.003/ T1036.003], 
-[https://attack.mitre.org/techniques/T1190/ T1190]
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
 Match Legitimate Name or Location, 
 Active Scanning, 
-OS Credential Dumping, 
-Service Stop, 
-Malicious File, 
-Data Destruction, 
-Account Access Removal, 
-Inhibit System Recovery, 
-File and Directory Permissions Modification, 
-SMB/Windows Admin Shares, 
-Service Execution, 
-System Information Discovery, 
-System Network Configuration Discovery, 
-Disable or Modify Tools, 
-Ingress Tool Transfer, 
-Account Discovery, 
-Masquerading, 
-Command and Scripting Interpreter, 
-Regsvr32, 
-Indirect Command Execution, 
-Scheduled Task/Job, 
-Exploitation for Client Execution, 
-Software Deployment Tools, 
-Remote Desktop Protocol, 
-Rundll32, 
-Data Encrypted for Impact, 
-Windows Service, 
-Create or Modify System Process, 
-Rename System Utilities, 
-Exploit Public-Facing Application
+OS Credential Dumping
 |
 Defense Evasion, 
 Reconnaissance, 
-Credential Access, 
-Impact, 
-Execution, 
-Impact, 
-Impact, 
-Impact, 
-Defense Evasion, 
-Lateral Movement, 
-Execution, 
-Discovery, 
-Discovery, 
-Defense Evasion, 
-Command And Control, 
-Discovery, 
-Defense Evasion, 
-Execution, 
-, 
-Defense Evasion, 
-Execution, Persistence, Privilege Escalation, 
-Execution, 
-Execution, Lateral Movement, 
-Lateral Movement, 
-Defense Evasion, 
-Impact, 
-Persistence, Privilege Escalation, 
-Persistence, Privilege Escalation, 
-Defense Evasion, 
-Initial Access
+Credential Access
 
 | TTP
 |-
@@ -15408,22 +13717,10 @@ Detect and investigate suspected abuse of file extensions and Windows file assoc
 | [[Documentation:ESSOC:detections:Detections#Execution_of_file_with_multiple_extensions|Execution of File with Multiple Extensions]]
 
 |
-[https://attack.mitre.org/techniques/T1036.003/ T1036.003], 
-[https://attack.mitre.org/techniques/T1127.001/ T1127.001], 
-[https://attack.mitre.org/techniques/T1218.011/ T1218.011], 
-[https://attack.mitre.org/techniques/T1127/ T1127], 
-[https://attack.mitre.org/techniques/T1036/ T1036]
+[https://attack.mitre.org/techniques/T1036.003/ T1036.003]
 |
-Rename System Utilities, 
-MSBuild, 
-Rundll32, 
-Trusted Developer Utilities Proxy Execution, 
-Masquerading
+Rename System Utilities
 |
-Defense Evasion, 
-Defense Evasion, 
-Defense Evasion, 
-Defense Evasion, 
 Defense Evasion
 
 | TTP
@@ -15469,26 +13766,11 @@ Windows services are often used by attackers for persistence and the ability to
 | [[Documentation:ESSOC:detections:Detections#First_time_seen_running_windows_service|First Time Seen Running Windows Service]]
 
 |
-[https://attack.mitre.org/techniques/T1569.002/ T1569.002], 
-[https://attack.mitre.org/techniques/T1055/ T1055], 
-[https://attack.mitre.org/techniques/T1106/ T1106], 
-[https://attack.mitre.org/techniques/T1569/ T1569], 
-[https://attack.mitre.org/techniques/T1574.011/ T1574.011], 
-[https://attack.mitre.org/techniques/T1543.003/ T1543.003]
+[https://attack.mitre.org/techniques/T1569.002/ T1569.002]
 |
-Service Execution, 
-Process Injection, 
-Native API, 
-System Services, 
-Services Registry Permissions Weakness, 
-Windows Service
+Service Execution
 |
-Execution, 
-Defense Evasion, Privilege Escalation, 
-Execution, 
-Execution, 
-Persistence, Privilege Escalation, Defense Evasion, 
-Persistence, Privilege Escalation
+Execution
 
 | Anomaly
 |-
@@ -15593,96 +13875,15 @@ Leverage searches that allow you to detect and investigate unusual activities th
 |
 [https://attack.mitre.org/techniques/T1036.005/ T1036.005], 
 [https://attack.mitre.org/techniques/T1595/ T1595], 
-[https://attack.mitre.org/techniques/T1003/ T1003], 
-[https://attack.mitre.org/techniques/T1489/ T1489], 
-[https://attack.mitre.org/techniques/T1204.002/ T1204.002], 
-[https://attack.mitre.org/techniques/T1485/ T1485], 
-[https://attack.mitre.org/techniques/T1531/ T1531], 
-[https://attack.mitre.org/techniques/T1490/ T1490], 
-[https://attack.mitre.org/techniques/T1222/ T1222], 
-[https://attack.mitre.org/techniques/T1021.002/ T1021.002], 
-[https://attack.mitre.org/techniques/T1569.002/ T1569.002], 
-[https://attack.mitre.org/techniques/T1082/ T1082], 
-[https://attack.mitre.org/techniques/T1016/ T1016], 
-[https://attack.mitre.org/techniques/T1562.001/ T1562.001], 
-[https://attack.mitre.org/techniques/T1105/ T1105], 
-[https://attack.mitre.org/techniques/T1087/ T1087], 
-[https://attack.mitre.org/techniques/T1036/ T1036], 
-[https://attack.mitre.org/techniques/T1059/ T1059], 
-[https://attack.mitre.org/techniques/T1117/ T1117], 
-[https://attack.mitre.org/techniques/T1202/ T1202], 
-[https://attack.mitre.org/techniques/T1053/ T1053], 
-[https://attack.mitre.org/techniques/T1203/ T1203], 
-[https://attack.mitre.org/techniques/T1072/ T1072], 
-[https://attack.mitre.org/techniques/T1021.001/ T1021.001], 
-[https://attack.mitre.org/techniques/T1218.011/ T1218.011], 
-[https://attack.mitre.org/techniques/T1486/ T1486], 
-[https://attack.mitre.org/techniques/T1543.003/ T1543.003], 
-[https://attack.mitre.org/techniques/T1543/ T1543], 
-[https://attack.mitre.org/techniques/T1036.003/ T1036.003], 
-[https://attack.mitre.org/techniques/T1190/ T1190]
+[https://attack.mitre.org/techniques/T1003/ T1003]
 |
 Match Legitimate Name or Location, 
 Active Scanning, 
-OS Credential Dumping, 
-Service Stop, 
-Malicious File, 
-Data Destruction, 
-Account Access Removal, 
-Inhibit System Recovery, 
-File and Directory Permissions Modification, 
-SMB/Windows Admin Shares, 
-Service Execution, 
-System Information Discovery, 
-System Network Configuration Discovery, 
-Disable or Modify Tools, 
-Ingress Tool Transfer, 
-Account Discovery, 
-Masquerading, 
-Command and Scripting Interpreter, 
-Regsvr32, 
-Indirect Command Execution, 
-Scheduled Task/Job, 
-Exploitation for Client Execution, 
-Software Deployment Tools, 
-Remote Desktop Protocol, 
-Rundll32, 
-Data Encrypted for Impact, 
-Windows Service, 
-Create or Modify System Process, 
-Rename System Utilities, 
-Exploit Public-Facing Application
+OS Credential Dumping
 |
 Defense Evasion, 
 Reconnaissance, 
-Credential Access, 
-Impact, 
-Execution, 
-Impact, 
-Impact, 
-Impact, 
-Defense Evasion, 
-Lateral Movement, 
-Execution, 
-Discovery, 
-Discovery, 
-Defense Evasion, 
-Command And Control, 
-Discovery, 
-Defense Evasion, 
-Execution, 
-, 
-Defense Evasion, 
-Execution, Persistence, Privilege Escalation, 
-Execution, 
-Execution, Lateral Movement, 
-Lateral Movement, 
-Defense Evasion, 
-Impact, 
-Persistence, Privilege Escalation, 
-Persistence, Privilege Escalation, 
-Defense Evasion, 
-Initial Access
+Credential Access
 
 | TTP
 |-
@@ -16147,7 +14348,7 @@ Discovery
 
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content
-# On Date: 2021-09-27 18:37:39.621200 UTC
+# On Date: 2021-10-14 15:40:37.356079 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############