diff --git a/detections/endpoint/detect_certipy_file_modifications.yml b/detections/endpoint/detect_certipy_file_modifications.yml index db6069b537..178f4374cd 100644 --- a/detections/endpoint/detect_certipy_file_modifications.yml +++ b/detections/endpoint/detect_certipy_file_modifications.yml @@ -60,7 +60,7 @@ rba: score: 45 threat_objects: - field: file_name - type: file name + type: file_name - field: process_name type: process_name tags: diff --git a/detections/endpoint/detect_remote_access_software_usage_file.yml b/detections/endpoint/detect_remote_access_software_usage_file.yml index 1024ad0838..ab2293eb4d 100644 --- a/detections/endpoint/detect_remote_access_software_usage_file.yml +++ b/detections/endpoint/detect_remote_access_software_usage_file.yml @@ -66,7 +66,7 @@ rba: score: 25 threat_objects: - field: file_name - type: file name + type: file_name tags: analytic_story: - Insider Threat diff --git a/detections/endpoint/detect_rtlo_in_file_name.yml b/detections/endpoint/detect_rtlo_in_file_name.yml index 987eacee05..5b3a7b07a3 100644 --- a/detections/endpoint/detect_rtlo_in_file_name.yml +++ b/detections/endpoint/detect_rtlo_in_file_name.yml @@ -58,7 +58,7 @@ rba: score: 40 threat_objects: - field: file_name - type: file name + type: file_name tags: analytic_story: - Spearphishing Attachments diff --git a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml index bb4e5ff74a..10ef43fe72 100644 --- a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml +++ b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml @@ -53,7 +53,7 @@ rba: score: 25 threat_objects: - field: deleted_files - type: file name + type: file_name tags: analytic_story: - Data Destruction diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index d591ef9d0d..e2dc18d3dc 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -63,7 +63,7 @@ rba: score: 20 threat_objects: - field: file_name - type: file name + type: file_name tags: analytic_story: - Double Zero Destructor diff --git a/detections/endpoint/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml index 2de5f9e595..f4995a1003 100644 --- a/detections/endpoint/file_with_samsam_extension.yml +++ b/detections/endpoint/file_with_samsam_extension.yml @@ -57,7 +57,7 @@ rba: score: 90 threat_objects: - field: file_name - type: file name + type: file_name tags: analytic_story: - SamSam Ransomware diff --git a/detections/endpoint/linux_deletion_of_cron_jobs.yml b/detections/endpoint/linux_deletion_of_cron_jobs.yml index 46f3eeef90..bc55de0520 100644 --- a/detections/endpoint/linux_deletion_of_cron_jobs.yml +++ b/detections/endpoint/linux_deletion_of_cron_jobs.yml @@ -49,7 +49,7 @@ rba: score: 49 threat_objects: - field: file_name - type: file name + type: file_name tags: analytic_story: - AcidRain diff --git a/detections/endpoint/linux_deletion_of_init_daemon_script.yml b/detections/endpoint/linux_deletion_of_init_daemon_script.yml index 2cb250ccc0..9c858d4399 100644 --- a/detections/endpoint/linux_deletion_of_init_daemon_script.yml +++ b/detections/endpoint/linux_deletion_of_init_daemon_script.yml @@ -49,7 +49,7 @@ rba: score: 49 threat_objects: - field: file_name - type: file name + type: file_name tags: analytic_story: - AcidRain diff --git a/detections/endpoint/linux_deletion_of_services.yml b/detections/endpoint/linux_deletion_of_services.yml index e29b39fca3..44ae7b051a 100644 --- a/detections/endpoint/linux_deletion_of_services.yml +++ b/detections/endpoint/linux_deletion_of_services.yml @@ -53,7 +53,7 @@ rba: score: 64 threat_objects: - field: file_name - type: file name + type: file_name tags: analytic_story: - AwfulShred diff --git a/detections/endpoint/linux_deletion_of_ssl_certificate.yml b/detections/endpoint/linux_deletion_of_ssl_certificate.yml index dee3ec4fd9..c625c7522a 100644 --- a/detections/endpoint/linux_deletion_of_ssl_certificate.yml +++ b/detections/endpoint/linux_deletion_of_ssl_certificate.yml @@ -51,7 +51,7 @@ rba: score: 49 threat_objects: - field: file_name - type: file name + type: file_name tags: analytic_story: - AcidRain diff --git a/detections/endpoint/network_traffic_to_active_directory_web_services_protocol.yml b/detections/endpoint/network_traffic_to_active_directory_web_services_protocol.yml index 3dc6c44233..aba09737dd 100644 --- a/detections/endpoint/network_traffic_to_active_directory_web_services_protocol.yml +++ b/detections/endpoint/network_traffic_to_active_directory_web_services_protocol.yml @@ -36,7 +36,7 @@ rba: on $dest_ip$ by $src_ip$. risk_objects: - field: dest_ip - type: ip address + type: system score: 10 threat_objects: - field: src_ip diff --git a/detections/endpoint/powershell_script_block_with_url_chain.yml b/detections/endpoint/powershell_script_block_with_url_chain.yml index ac2fd739b8..036c441c7b 100644 --- a/detections/endpoint/powershell_script_block_with_url_chain.yml +++ b/detections/endpoint/powershell_script_block_with_url_chain.yml @@ -57,7 +57,7 @@ rba: score: 80 threat_objects: - field: file_name - type: file name + type: file_name - field: url type: url string tags: diff --git a/detections/endpoint/powershell_webrequest_using_memory_stream.yml b/detections/endpoint/powershell_webrequest_using_memory_stream.yml index 155d170528..eeff1be338 100644 --- a/detections/endpoint/powershell_webrequest_using_memory_stream.yml +++ b/detections/endpoint/powershell_webrequest_using_memory_stream.yml @@ -55,7 +55,7 @@ rba: score: 80 threat_objects: - field: file_name - type: file name + type: file_name tags: analytic_story: - Malicious PowerShell diff --git a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml index 911aebbe0b..672c9478a6 100644 --- a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml +++ b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml @@ -47,7 +47,7 @@ rba: score: 80 threat_objects: - field: file_name - type: file name + type: file_name tags: analytic_story: - IcedID diff --git a/detections/endpoint/suspicious_driver_loaded_path.yml b/detections/endpoint/suspicious_driver_loaded_path.yml index b597e8436f..0788129a80 100644 --- a/detections/endpoint/suspicious_driver_loaded_path.yml +++ b/detections/endpoint/suspicious_driver_loaded_path.yml @@ -50,7 +50,7 @@ rba: score: 63 threat_objects: - field: file_name - type: file name + type: file_name tags: analytic_story: - XMRig diff --git a/detections/endpoint/suspicious_process_executed_from_container_file.yml b/detections/endpoint/suspicious_process_executed_from_container_file.yml index 2d1a74cd58..751afb1538 100644 --- a/detections/endpoint/suspicious_process_executed_from_container_file.yml +++ b/detections/endpoint/suspicious_process_executed_from_container_file.yml @@ -62,7 +62,7 @@ rba: score: 16 threat_objects: - field: file_name - type: file name + type: file_name tags: analytic_story: - Unusual Processes diff --git a/detections/endpoint/windows_admin_permission_discovery.yml b/detections/endpoint/windows_admin_permission_discovery.yml index 6260097bf5..1ca38ac112 100644 --- a/detections/endpoint/windows_admin_permission_discovery.yml +++ b/detections/endpoint/windows_admin_permission_discovery.yml @@ -54,7 +54,7 @@ rba: score: 25 threat_objects: - field: file_name - type: file name + type: file_name tags: analytic_story: - NjRAT diff --git a/detections/endpoint/windows_alternate_datastream___base64_content.yml b/detections/endpoint/windows_alternate_datastream___base64_content.yml index 7fb0d213aa..b8c3951e6c 100644 --- a/detections/endpoint/windows_alternate_datastream___base64_content.yml +++ b/detections/endpoint/windows_alternate_datastream___base64_content.yml @@ -58,7 +58,7 @@ rba: score: 80 threat_objects: - field: file_name - type: file name + type: file_name tags: analytic_story: - Windows Defense Evasion Tactics diff --git a/detections/endpoint/windows_alternate_datastream___executable_content.yml b/detections/endpoint/windows_alternate_datastream___executable_content.yml index f9c312845d..4598163b0c 100644 --- a/detections/endpoint/windows_alternate_datastream___executable_content.yml +++ b/detections/endpoint/windows_alternate_datastream___executable_content.yml @@ -53,7 +53,7 @@ rba: score: 80 threat_objects: - field: file_name - type: file name + type: file_name - field: file_hash type: file hash tags: diff --git a/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml b/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml index 189181e990..b77cb424e8 100644 --- a/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml +++ b/detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml @@ -55,7 +55,7 @@ rba: score: 64 threat_objects: - field: deleted_files - type: file name + type: file_name tags: analytic_story: - Swift Slicer diff --git a/detections/endpoint/windows_high_file_deletion_frequency.yml b/detections/endpoint/windows_high_file_deletion_frequency.yml index 18a9f0f026..96c40500f4 100644 --- a/detections/endpoint/windows_high_file_deletion_frequency.yml +++ b/detections/endpoint/windows_high_file_deletion_frequency.yml @@ -60,7 +60,7 @@ rba: score: 72 threat_objects: - field: deleted_files - type: file name + type: file_name - field: process_name type: process_name tags: diff --git a/detections/endpoint/windows_mshta_writing_to_world_writable_path.yml b/detections/endpoint/windows_mshta_writing_to_world_writable_path.yml index 6af6f368d0..981bc7bc1a 100644 --- a/detections/endpoint/windows_mshta_writing_to_world_writable_path.yml +++ b/detections/endpoint/windows_mshta_writing_to_world_writable_path.yml @@ -64,7 +64,7 @@ rba: score: 64 threat_objects: - field: Image - type: file name + type: file_name tags: analytic_story: - APT29 Diplomatic Deceptions with WINELOADER diff --git a/detections/endpoint/windows_replication_through_removable_media.yml b/detections/endpoint/windows_replication_through_removable_media.yml index 84ec092c06..94074bed5f 100644 --- a/detections/endpoint/windows_replication_through_removable_media.yml +++ b/detections/endpoint/windows_replication_through_removable_media.yml @@ -57,7 +57,7 @@ rba: score: 64 threat_objects: - field: file_name - type: file name + type: file_name tags: analytic_story: - Chaos Ransomware diff --git a/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml b/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml index 501ab1c678..3e4a52497f 100644 --- a/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml +++ b/detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml @@ -57,7 +57,7 @@ rba: score: 64 threat_objects: - field: Image - type: file name + type: file_name tags: analytic_story: - APT29 Diplomatic Deceptions with WINELOADER diff --git a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml index 6a229b1afe..419150cdae 100644 --- a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml @@ -61,7 +61,7 @@ rba: score: 9 threat_objects: - field: Image - type: file name + type: file_name tags: analytic_story: - APT29 Diplomatic Deceptions with WINELOADER