From 912f23fc7b6d5457cd2bc55247c05f1fa7b364ff Mon Sep 17 00:00:00 2001 From: truptilangalia-crest Date: Mon, 25 Apr 2022 15:26:56 +0550 Subject: [PATCH] Updated detection files with recommended TA list. --- .../active_setup_registry_autostart.yml | 2 - ...d_defaultuser_and_password_in_registry.yml | 2 - ...ound_traffic_by_firewall_rule_registry.yml | 2 - .../allow_operation_with_consent_admin.yml | 2 - .../auto_admin_logon_registry_entry.yml | 2 - .../change_default_file_association.yml | 2 - .../endpoint/chcp_command_execution.yml | 2 + ...ate_local_admin_accounts_using_net_exe.yml | 1 + .../detect_azurehound_file_modifications.yml | 2 + ...cessive_account_lockouts_from_endpoint.yml | 2 + .../detect_sharphound_file_modifications.yml | 2 + .../disable_amsi_through_registry.yml | 2 - .../disable_defender_antivirus_registry.yml | 2 - ...able_defender_blockatfirstseen_feature.yml | 2 - ...disable_defender_enhanced_notification.yml | 2 - .../disable_defender_mpengine_registry.yml | 2 - .../disable_defender_spynet_reporting.yml | 2 - ...efender_submit_samples_consent_feature.yml | 2 - .../endpoint/disable_etw_through_registry.yml | 2 - detections/endpoint/disable_registry_tool.yml | 2 - ...le_security_logs_using_minint_registry.yml | 2 - .../disable_uac_remote_restriction.yml | 2 - .../endpoint/disable_windows_app_hotkeys.yml | 2 - .../disable_windows_behavior_monitoring.yml | 2 - .../endpoint/disabling_cmd_application.yml | 2 - .../endpoint/disabling_controlpanel.yml | 2 - .../endpoint/disabling_defender_services.yml | 2 - .../endpoint/disabling_norun_windows_app.yml | 2 - .../disabling_systemrestore_in_registry.yml | 2 - .../endpoint/disabling_task_manager.yml | 2 - .../enable_rdp_in_other_port_number.yml | 2 - ...le_wdigest_uselogoncredential_registry.yml | 2 - detections/endpoint/etw_registry_disabled.yml | 2 - detections/endpoint/eventvwr_uac_bypass.yml | 2 - .../excel_spawning_windows_script_host.yml | 2 + ..._or_script_creation_in_suspicious_path.yml | 2 - .../hide_user_account_from_sign_in_screen.yml | 2 - .../logon_script_event_trigger_execution.yml | 2 - ...z_passtheticket_commandline_parameters.yml | 2 + .../msmpeng_application_dll_side_loading.yml | 2 - .../office_application_drop_executable.yml | 2 + .../registry_keys_used_for_persistence.yml | 2 - .../remcos_client_registry_install_entry.yml | 2 - ...cos_rat_file_creation_in_remcos_folder.yml | 2 + detections/endpoint/revil_registry_entry.yml | 2 - .../rubeus_command_line_parameters.yml | 2 + ...no_command_line_arguments_with_network.yml | 2 - .../rundll_loading_dll_by_ordinal.yml | 2 + .../endpoint/ryuk_test_files_detected.yml | 2 + .../screensaver_event_trigger_execution.yml | 2 - detections/endpoint/sdclt_uac_bypass.yml | 2 - .../endpoint/shim_database_file_creation.yml | 2 + .../endpoint/silentcleanup_uac_bypass.yml | 2 - ..._windows_rundll32_inline_hta_execution.yml | 2 - .../start_up_during_safe_mode_boot.yml | 2 - ...spicious_writes_to_windows_recycle_bin.yml | 2 + ...ost_exe_lolbas_execution_process_spawn.yml | 2 + .../time_provider_persistence_registry.yml | 2 - ...dows_defender_exclusion_registry_entry.yml | 2 - .../windows_disableantispyware_reg.yml | 2 - .../windows_diskshadow_proxy_execution.yml | 2 + ...ows_process_with_namedpipe_commandline.yml | 2 + .../windows_rasautou_dll_execution.yml | 2 + ...ows_remote_assistance_spawning_process.yml | 2 + .../windows_schtasks_create_run_as_system.yml | 2 + ...ndows_security_account_manager_stopped.yml | 2 + .../winword_spawning_windows_script_host.yml | 2 + detections/endpoint/wsreset_uac_bypass.yml | 2 - ...ry_length_with_high_standard_deviation.yml | 2 - .../detection_ta_mapping.csv | 612 +++--- .../detection_ta_mapping.yml | 1650 +++++++++-------- 71 files changed, 1190 insertions(+), 1209 deletions(-) diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index dae2e86ad4..2919cb9e89 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -85,5 +85,3 @@ tags: - _time risk_score: 64 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index bdd0483628..14256357b2 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -80,5 +80,3 @@ tags: - _time risk_score: 25 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index cd8739451a..924c011d60 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -84,5 +84,3 @@ tags: - _time risk_score: 3 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index 185d4c1075..b1bb124032 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -85,5 +85,3 @@ tags: - _time risk_score: 25 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/auto_admin_logon_registry_entry.yml b/detections/endpoint/auto_admin_logon_registry_entry.yml index fc224895c7..397de312ca 100644 --- a/detections/endpoint/auto_admin_logon_registry_entry.yml +++ b/detections/endpoint/auto_admin_logon_registry_entry.yml @@ -80,5 +80,3 @@ tags: - _time risk_score: 63 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/change_default_file_association.yml b/detections/endpoint/change_default_file_association.yml index 74e0977ad0..4934d75b8a 100644 --- a/detections/endpoint/change_default_file_association.yml +++ b/detections/endpoint/change_default_file_association.yml @@ -66,5 +66,3 @@ tags: - _time risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml index 277954819b..3529a07848 100644 --- a/detections/endpoint/chcp_command_execution.yml +++ b/detections/endpoint/chcp_command_execution.yml @@ -74,3 +74,5 @@ tags: - user risk_score: 9 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index 4d51b47fef..c086a9889b 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -82,3 +82,4 @@ tags: security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows diff --git a/detections/endpoint/detect_azurehound_file_modifications.yml b/detections/endpoint/detect_azurehound_file_modifications.yml index 605ec25240..788760109a 100644 --- a/detections/endpoint/detect_azurehound_file_modifications.yml +++ b/detections/endpoint/detect_azurehound_file_modifications.yml @@ -82,3 +82,5 @@ tags: - process_id risk_score: 63 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml index c823c67b9c..7af53b9aa5 100644 --- a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml +++ b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml @@ -73,3 +73,5 @@ tags: - Change.All_Changes.dest risk_score: 36 security_domain: access + supported_tas: + - Splunk_TA_windows diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml index 5e3df344d3..adef0e7dc5 100644 --- a/detections/endpoint/detect_sharphound_file_modifications.yml +++ b/detections/endpoint/detect_sharphound_file_modifications.yml @@ -88,3 +88,5 @@ tags: - process_id risk_score: 24 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index 3b0c18f7de..2b1cecffd0 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -64,5 +64,3 @@ tags: - Endpoint.Registry.user - _time security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index 8d03173a87..54bbc2715e 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -79,5 +79,3 @@ tags: - _time risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index d1d7181beb..e63976df17 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -78,5 +78,3 @@ tags: - _time risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index e6d67a67ca..4bc8324f55 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -78,5 +78,3 @@ tags: - _time risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml index c478a53084..bed63f29f3 100644 --- a/detections/endpoint/disable_defender_mpengine_registry.yml +++ b/detections/endpoint/disable_defender_mpengine_registry.yml @@ -79,5 +79,3 @@ tags: - _time risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index 95a5e8bbe0..2d47d776ac 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -77,5 +77,3 @@ tags: - _time risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index 70c6cbbf75..4f23765f4b 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -77,5 +77,3 @@ tags: - _time risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index 868806d19a..e39ccec8a8 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -63,5 +63,3 @@ tags: - Endpoint.Registry.user - _time security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index bd1e31e428..dab346f830 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -77,5 +77,3 @@ tags: - _time risk_score: 40 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index 25c7cee522..21ddc740c1 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -78,5 +78,3 @@ tags: - _time risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml index 70a14acc92..1499e692ff 100644 --- a/detections/endpoint/disable_uac_remote_restriction.yml +++ b/detections/endpoint/disable_uac_remote_restriction.yml @@ -82,5 +82,3 @@ tags: - _time risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index 8536f1aae6..46c209a9a4 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -80,5 +80,3 @@ tags: - _time risk_score: 40 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index c03c79cb4b..18712a67e9 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -84,5 +84,3 @@ tags: - _time risk_score: 40 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index d127d0c550..7c1b261704 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -82,5 +82,3 @@ tags: - _time risk_score: 25 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index c9b3a4f375..ddd4bc4c37 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -81,5 +81,3 @@ tags: - _time risk_score: 25 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml index 690a89fb5a..07830b8d90 100644 --- a/detections/endpoint/disabling_defender_services.yml +++ b/detections/endpoint/disabling_defender_services.yml @@ -80,5 +80,3 @@ tags: - _time risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index 2397299a56..6c614d42b1 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -85,5 +85,3 @@ tags: - _time risk_score: 25 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 0ad46ada60..8360a624a1 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -84,5 +84,3 @@ tags: - _time risk_score: 49 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index c113937187..22398c9d27 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -83,5 +83,3 @@ tags: - _time risk_score: 42 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index f9974a40f5..fc78dbcbfd 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -78,5 +78,3 @@ tags: - _time risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index 57588d47e5..d4ad797fe0 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -84,5 +84,3 @@ tags: - _time risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index 6ca2a31359..295674c216 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -84,5 +84,3 @@ tags: - _time risk_score: 90 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index 5e37b82160..bff03136ec 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -89,5 +89,3 @@ tags: - _time risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/endpoint/excel_spawning_windows_script_host.yml index 41b78bdd98..a446f87d98 100644 --- a/detections/endpoint/excel_spawning_windows_script_host.yml +++ b/detections/endpoint/excel_spawning_windows_script_host.yml @@ -84,3 +84,5 @@ tags: - user risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 75e6d5b0ed..ca55dc6627 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -80,5 +80,3 @@ tags: - _time risk_score: 56 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index 726d2986c8..cf01b74b0d 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -90,5 +90,3 @@ tags: - _time risk_score: 72 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/logon_script_event_trigger_execution.yml b/detections/endpoint/logon_script_event_trigger_execution.yml index 764a375eb7..024ac56203 100644 --- a/detections/endpoint/logon_script_event_trigger_execution.yml +++ b/detections/endpoint/logon_script_event_trigger_execution.yml @@ -64,5 +64,3 @@ tags: - _time risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml index 967dc32b26..103136eed0 100644 --- a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml +++ b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml @@ -73,3 +73,5 @@ tags: - _time risk_score: 36 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml index 38d9253ebe..407fcf6b7f 100644 --- a/detections/endpoint/msmpeng_application_dll_side_loading.yml +++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml @@ -47,5 +47,3 @@ tags: - Endpoint.Filesystem.user - _time security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/office_application_drop_executable.yml index 9dd051dc3c..02ac2b4863 100644 --- a/detections/endpoint/office_application_drop_executable.yml +++ b/detections/endpoint/office_application_drop_executable.yml @@ -79,3 +79,5 @@ tags: - dest risk_score: 64 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index c8fca5c6df..6e9f0f2bee 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -109,5 +109,3 @@ tags: - _time risk_score: 76 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 21bd34ab65..0c072910ce 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -71,5 +71,3 @@ tags: - _time risk_score: 90 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml index 412bef8481..72b438f108 100644 --- a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml +++ b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml @@ -60,3 +60,5 @@ tags: - file_path risk_score: 100 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index c51c42758a..84eda27850 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -80,5 +80,3 @@ tags: - _time risk_score: 60 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml index 0d33a9eb7f..0dae4d1db5 100644 --- a/detections/endpoint/rubeus_command_line_parameters.yml +++ b/detections/endpoint/rubeus_command_line_parameters.yml @@ -84,3 +84,5 @@ tags: - _time risk_score: 36 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index 82b48ce8be..59c963e9a2 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -86,5 +86,3 @@ tags: - _time risk_score: 70 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml index 6e331e09e1..9f1a39d481 100644 --- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml +++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml @@ -79,3 +79,5 @@ tags: - _time risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml index 50fe687bf7..53c51c6c21 100644 --- a/detections/endpoint/ryuk_test_files_detected.yml +++ b/detections/endpoint/ryuk_test_files_detected.yml @@ -61,3 +61,5 @@ tags: - _time risk_score: 70 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml index 7a289dbcbf..239967574e 100644 --- a/detections/endpoint/screensaver_event_trigger_execution.yml +++ b/detections/endpoint/screensaver_event_trigger_execution.yml @@ -67,5 +67,3 @@ tags: - _time risk_score: 72 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/sdclt_uac_bypass.yml b/detections/endpoint/sdclt_uac_bypass.yml index af0139d910..1e31323b2f 100644 --- a/detections/endpoint/sdclt_uac_bypass.yml +++ b/detections/endpoint/sdclt_uac_bypass.yml @@ -82,5 +82,3 @@ tags: - _time risk_score: 63 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml index b5fe03b7b4..1b1a1c6de6 100644 --- a/detections/endpoint/shim_database_file_creation.yml +++ b/detections/endpoint/shim_database_file_creation.yml @@ -69,3 +69,5 @@ tags: - _time risk_score: 56 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/silentcleanup_uac_bypass.yml b/detections/endpoint/silentcleanup_uac_bypass.yml index 946658479d..f99ede15c1 100644 --- a/detections/endpoint/silentcleanup_uac_bypass.yml +++ b/detections/endpoint/silentcleanup_uac_bypass.yml @@ -80,5 +80,3 @@ tags: - _time risk_score: 63 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml b/detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml index bf836b15dc..14fbc6b2dd 100644 --- a/detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml +++ b/detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml @@ -94,5 +94,3 @@ tags: - cmd_line risk_score: 56 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/start_up_during_safe_mode_boot.yml b/detections/endpoint/start_up_during_safe_mode_boot.yml index 0ecdbe7515..04b6eb8af4 100644 --- a/detections/endpoint/start_up_during_safe_mode_boot.yml +++ b/detections/endpoint/start_up_during_safe_mode_boot.yml @@ -76,5 +76,3 @@ tags: - _time risk_score: 42 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml index 60bab4d380..d6645d1efc 100644 --- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml +++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml @@ -70,3 +70,5 @@ tags: - _time risk_score: 28 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml index 7541198ce2..a98ee1b4a2 100644 --- a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml @@ -75,3 +75,5 @@ tags: - _time risk_score: 54 security_domain: endpoint + supported_tas: + - Splunk_TA_windows diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index f1c4f3a888..fc8079f93e 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -83,5 +83,3 @@ tags: - _time risk_score: 80 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml index d592c7a17e..a357db6bd2 100644 --- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml +++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml @@ -83,5 +83,3 @@ tags: - _time risk_score: 64 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml index f080e9860b..1b70364530 100644 --- a/detections/endpoint/windows_disableantispyware_reg.yml +++ b/detections/endpoint/windows_disableantispyware_reg.yml @@ -68,5 +68,3 @@ tags: - _time risk_score: 24 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_diskshadow_proxy_execution.yml b/detections/endpoint/windows_diskshadow_proxy_execution.yml index 9b7a1f75c8..4435232587 100644 --- a/detections/endpoint/windows_diskshadow_proxy_execution.yml +++ b/detections/endpoint/windows_diskshadow_proxy_execution.yml @@ -67,3 +67,5 @@ tags: - _time risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_process_with_namedpipe_commandline.yml b/detections/endpoint/windows_process_with_namedpipe_commandline.yml index 76b693166e..f67d013326 100644 --- a/detections/endpoint/windows_process_with_namedpipe_commandline.yml +++ b/detections/endpoint/windows_process_with_namedpipe_commandline.yml @@ -75,3 +75,5 @@ tags: - _time risk_score: 49 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_rasautou_dll_execution.yml b/detections/endpoint/windows_rasautou_dll_execution.yml index 74a71931f8..d5a5998460 100644 --- a/detections/endpoint/windows_rasautou_dll_execution.yml +++ b/detections/endpoint/windows_rasautou_dll_execution.yml @@ -75,3 +75,5 @@ tags: - _time risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_remote_assistance_spawning_process.yml b/detections/endpoint/windows_remote_assistance_spawning_process.yml index aaaca39e14..20c8439bee 100644 --- a/detections/endpoint/windows_remote_assistance_spawning_process.yml +++ b/detections/endpoint/windows_remote_assistance_spawning_process.yml @@ -72,3 +72,5 @@ tags: - _time risk_score: 80 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_schtasks_create_run_as_system.yml b/detections/endpoint/windows_schtasks_create_run_as_system.yml index 96f26939a7..8c42b4d1b2 100644 --- a/detections/endpoint/windows_schtasks_create_run_as_system.yml +++ b/detections/endpoint/windows_schtasks_create_run_as_system.yml @@ -69,3 +69,5 @@ tags: - _time risk_score: 48 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml index 5ff1e20b4a..82a51f5c34 100644 --- a/detections/endpoint/windows_security_account_manager_stopped.yml +++ b/detections/endpoint/windows_security_account_manager_stopped.yml @@ -69,3 +69,5 @@ tags: - _time risk_score: 70 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/endpoint/winword_spawning_windows_script_host.yml index dee31f18b1..8cca6248b5 100644 --- a/detections/endpoint/winword_spawning_windows_script_host.yml +++ b/detections/endpoint/winword_spawning_windows_script_host.yml @@ -81,3 +81,5 @@ tags: - user risk_score: 70 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml index c41fe22d36..45d203ad55 100644 --- a/detections/endpoint/wsreset_uac_bypass.yml +++ b/detections/endpoint/wsreset_uac_bypass.yml @@ -82,5 +82,3 @@ tags: - _time risk_score: 63 security_domain: endpoint - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml index 2ba090afaa..c58b77427b 100644 --- a/detections/network/dns_query_length_with_high_standard_deviation.yml +++ b/detections/network/dns_query_length_with_high_standard_deviation.yml @@ -66,5 +66,3 @@ tags: - Network_Resolution.DNS.query risk_score: 56 security_domain: network - supported_tas: - - Splunk_TA_microsoft_sysmon diff --git a/security_content_automation/detection_ta_mapping.csv b/security_content_automation/detection_ta_mapping.csv index 4ce0deb0aa..e9344f415f 100644 --- a/security_content_automation/detection_ta_mapping.csv +++ b/security_content_automation/detection_ta_mapping.csv @@ -1,317 +1,297 @@ detection_name,cim_version,supported_tas,tas_with_cim_mapping -abnormally_high_number_of_cloud_security_group_api_calls,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" -cloud_api_calls_from_previously_unseen_user_roles,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, splunk_ta_o365, Splunk_TA_box, Splunk_TA_infoblox, Splunk_TA_salesforce" -cloud_compute_instance_created_in_previously_unused_region,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose -cloud_provisioning_from_previously_unseen_country,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" -cloud_compute_instance_created_with_previously_unseen_instance_type,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose -cloud_compute_instance_created_by_previously_unseen_user,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose -cloud_provisioning_from_previously_unseen_region,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" -abnormally_high_number_of_cloud_infrastructure_api_calls,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" -cloud_compute_instance_created_with_previously_unseen_image,5.0.0,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose -cloud_provisioning_from_previously_unseen_city,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" -cloud_provisioning_from_previously_unseen_ip_address,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_salesforce" -cloud_instance_modified_with_previously_unseen_user,5.0.0,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_salesforce" -linux_setuid_using_chmod_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -disabling_folderoptions_windows_feature,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -anomalous_usage_of_7zip,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -enable_rdp_in_other_port_number,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -excessive_number_of_taskhost_processes,5.0.0,Splunk_TA_windows,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" -xsl_script_execution_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -rundll32_control_rundll_world_writable_directory,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disable_schedule_task,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -serviceprincipalnames_discovery_with_setspn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -allow_operation_with_consent_admin,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -windows_service_initiation_on_remote_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -spoolsv_writing_a_dll,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -dsquery_domain_discovery,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -linux_possible_access_or_modification_of_sshd_config_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -secretdumps_offline_ntds_dumping_tool,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -attacker_tools_on_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" -domain_account_discovery_with_net_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -certutil_exe_certificate_extraction,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_html_help_url_in_command_line,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -prevent_automatic_repair_mode_using_bcdedit,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_possible_access_to_sudoers_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -get_domainpolicy_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -excessive_number_of_distinct_processes_created_in_windows_temp_folder,5.0.0,Splunk_TA_windows,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" -disable_registry_tool,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -powershell_disable_security_monitoring,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -svchost_exe_lolbas_execution_process_spawn,5.0.0,,Splunk_TA_microsoft_sysmon -disable_defender_spynet_reporting,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -certutil_download_with_verifyctl_and_split_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_nirsoft_advancedrun,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -cmd_echo_pipe___escalation,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -excessive_number_of_service_control_start_as_disabled,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -windows_installutil_url_in_command_line,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_use_of_cmd_exe_to_launch_script_interpreters,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -suspicious_icedid_rundll32_cmdline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -excessive_service_stop_attempt,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_copy_on_system32,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -credential_dumping_via_symlink_to_shadow_copy,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_searchprotocolhost_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -excessive_usage_of_net_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -permission_modification_using_takeown_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_at_application_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -reg_exe_manipulating_windows_services_registry_keys,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -logon_script_event_trigger_execution,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_possible_ssh_key_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -dump_lsass_via_procdump,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -getwmiobject_ds_computer_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -sdclt_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -hide_user_account_from_sign_in_screen,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -deleting_of_net_users,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -revil_registry_entry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_psexec_with_accepteula_flag,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -remote_process_instantiation_via_dcom_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -auto_admin_logon_registry_entry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_doas_tool_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -modify_acl_permission_to_files_or_folder,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -getdomaingroup_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disable_amsi_through_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -wermgr_process_spawned_cmd_or_powershell_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_azurehound_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -office_product_spawning_rundll32_with_no_dll,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_exchange_web_shell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -time_provider_persistence_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -system_processes_run_from_unexpected_locations,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -scheduled_task_initiation_on_remote_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -sc_exe_manipulating_windows_services,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -disable_defender_submit_samples_consent_feature,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -ryuk_wake_on_lan_command,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -suspicious_msbuild_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_possible_access_to_credential_files,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -suspicious_wevtutil_usage,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -excessive_usage_of_cacls_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -disabling_task_manager,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -office_document_spawned_child_process_to_download,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -processes_launching_netsh,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_possible_append_command_to_at_allow_config_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -single_letter_process_on_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" -check_elevated_cmd_using_whoami,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -short_lived_windows_accounts,5.0.0,,"Splunk_TA_microsoft-cloudservices, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_cyberark" -possible_lateral_movement_powershell_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -schtasks_scheduling_job_on_remote_system,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -executables_or_script_creation_in_suspicious_path,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -active_setup_registry_autostart,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -suspicious_rundll32_with_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -winword_spawning_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_regsvr32_register_suspicious_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_install_kernel_module_using_modprobe_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -scheduled_task_creation_on_remote_endpoint_using_at,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_possible_append_command_to_profile_config_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -nishang_powershelltcponeline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_mshta_url_in_command_line,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_sudoers_tmp_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_service_restarted,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -disabling_defender_services,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -getwmiobject_ds_group_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -firewall_allowed_program_enable,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -office_application_spawn_regsvr32_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_rundll32_inline_hta_execution,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_gpupdate_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -extraction_of_registry_hives,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -powershell_start_bitstransfer,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_mshta_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_rundll32_application_control_bypass___setupapi,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -recursive_delete_of_directory_in_batch_cmd,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -get_aduserresultantpasswordpolicy_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -windows_dotnet_binary_in_non_standard_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -net_profiler_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disable_etw_through_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -remote_process_instantiation_via_winrm_and_winrs,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -office_product_spawning_wmic,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -execution_of_file_with_multiple_extensions,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" -remote_process_instantiation_via_winrm_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_process_file_path,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -any_powershell_downloadstring,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_change_file_owner_to_root,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -process_creating_lnk_file_in_suspicious_location,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -wbadmin_delete_system_backups,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -linux_pkexec_privilege_escalation,5.0.0,,Splunk_TA_microsoft_sysmon -disabling_controlpanel,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -attempt_to_stop_security_service,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -excel_spawning_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -allow_inbound_traffic_by_firewall_rule_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -getdomaincomputer_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -malicious_powershell_process___execution_policy_bypass,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disable_defender_enhanced_notification,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -fodhelper_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_regsvr32_application_control_bypass,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_curl_download_to_suspicious_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -remcos_client_registry_install_entry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_microsoft_workflow_compiler_usage,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -bcdedit_failure_recovery_modification,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -linux_service_file_created_in_systemd_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -slui_runas_elevated,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -batch_file_write_to_system32,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" -windows_dism_remove_defender,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -excessive_usage_of_taskkill,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -nltest_domain_trust_discovery,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -fsutil_zeroing_file,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -office_application_spawn_rundll32_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -add_or_set_windows_defender_exclusion,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -bitsadmin_download_file,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -print_processor_registry_autostart,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_path_interception_by_creation_of_program_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -cmdline_tool_not_executed_in_cmd_shell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_mshta_inline_hta_execution,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_rundll32_startw,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -script_execution_via_wmi,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" -slui_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -scheduled_task_deleted_or_created_via_cmd,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -allow_network_discovery_in_firewall,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_file_created_in_kernel_driver_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disable_logs_using_wevtutil,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -revil_common_exec_parameter,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_sharphound_usage,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -wmiprsve_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_file_creation_in_profile_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -services_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -regsvr32_with_known_silent_switch_cmdline,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_installutil_uninstall_option,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -deleting_shadow_copies,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -winhlp32_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disabling_firewall_with_netsh,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -elevated_group_discovery_with_net,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_setuid_using_setcap_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -linux_preload_hijack_library_calls,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -windows_installutil_in_non_standard_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -get_foresttrust_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_defender_exclusion_registry_entry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_adfind_exe,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disabling_cmd_application,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -msmpeng_application_dll_side_loading,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -account_discovery_with_net_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_insert_kernel_module_using_insmod_utility,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -certutil_download_with_urlcache_and_split_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_msbuild_rename,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_mshta_child_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -set_default_powershell_execution_policy_to_unrestricted_or_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -uninstall_app_using_msiexec,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -execute_javascript_with_jscript_com_clsid,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -create_local_admin_accounts_using_net_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disable_uac_remote_restriction,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_doas_conf_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -creation_of_shadow_copy,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_file_creation_in_init_boot_directory,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -windows_disableantispyware_reg,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disable_defender_mpengine_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -getwmiobject_ds_user_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disable_windows_app_hotkeys,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -dns_exfiltration_using_nslookup_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -clear_unallocated_sector_using_cipher_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_java_spawning_shell,5.0.0,,Splunk_TA_microsoft_sysmon -disable_defender_blockatfirstseen_feature,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -remote_process_instantiation_via_wmi_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_regsvcs_with_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -get_domaintrust_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_installutil_credential_theft,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -elevated_group_discovery_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -registry_keys_used_for_persistence,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_rundll32_application_control_bypass___syssetup,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -ping_sleep_batch_command,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_processes_used_for_system_network_configuration_discovery,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -clop_common_exec_parameter,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -office_product_spawning_certutil,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -regsvr32_silent_and_install_param_dll_loading,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -msbuild_suspicious_spawned_by_script_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -hiding_files_and_directories_with_attrib_exe,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" -office_product_spawn_cmd_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -wsreset_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -certutil_with_decode_argument,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -allow_file_and_printing_sharing_in_firewall,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -system_information_discovery_detection,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" -malicious_powershell_process_with_obfuscation_techniques,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_add_files_in_known_crontab_directories,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -eventvwr_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -icacls_deny_command,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -usn_journal_deletion,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -remote_system_discovery_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_html_help_using_infotech_storage_handlers,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disable_security_logs_using_minint_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -sdelete_application_execution,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -curl_download_and_bash_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -icacls_grant_command,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -winword_spawning_cmd,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -credential_dumping_via_copy_command_from_shadow_copy,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_regasm_with_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -enable_wdigest_uselogoncredential_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -control_loading_from_world_writable_directory,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -remote_process_instantiation_via_wmi,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_dllhost_no_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -spoolsv_spawning_rundll32,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -conti_common_exec_parameter,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -attempted_credential_dump_from_registry_via_reg_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -jscript_execution_using_cscript_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -bcdedit_command_back_to_normal_mode_boot,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -rundll32_shimcache_flush,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -screensaver_event_trigger_execution,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -office_product_spawning_bitsadmin,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -change_default_file_association,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -wscript_or_cscript_suspicious_child_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -domain_controller_discovery_with_nltest,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disable_windows_behavior_monitoring,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -windows_curl_upload_to_remote_destination,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -unified_messaging_service_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_html_help_spawn_child_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_regsvcs_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -linux_service_started_or_enabled,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -java_class_file_download_by_java_user_agent,5.0.0,,"Splunk_TA_citrix-netscaler, Splunk_TA_nginx, Splunk_TA_microsoft-iis, Splunk_TA_websense-cg, Splunk_TA_squid, Splunk_TA_haproxy, Splunk_TA_mcafee-wg, Splunk_TA_cisco-wsa" -linux_at_allow_config_file_creation,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disable_defender_antivirus_registry,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_visudo_utility_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -schtasks_run_task_on_demand,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -schtasks_used_for_forcing_a_reboot,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -windows_raccine_scheduled_task_deletion,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -mshta_spawning_rundll32_or_regsvr32_process,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -excessive_attempt_to_disable_services,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -get_domainuser_with_powershell,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -suspicious_scheduled_task_from_public_directory,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -rundll32_with_no_command_line_arguments_with_network,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -windows_service_creation_on_remote_endpoint,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -linux_nopasswd_entry_in_sudoers_file,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -attempt_to_add_certificate_to_untrusted_store,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -process_kill_base_on_file_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -wsmprovhost_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -domain_account_discovery_with_wmic,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disabling_norun_windows_app,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -suspicious_rundll32_plugininit,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -file_with_samsam_extension,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" -silentcleanup_uac_bypass,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -ntdsutil_export_ntds,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -disabling_systemrestore_in_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -vbscript_execution_using_wscript_app,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -office_spawning_control,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_regasm_spawning_a_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -start_up_during_safe_mode_boot,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -office_product_spawning_mshta,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -change_to_safe_mode_with_network_config,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -potentially_malicious_code_on_commandline,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_rundll32_application_control_bypass___advpack,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -services_escalate_exe,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -wget_download_and_bash_execution,5.0.0,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -remote_wmi_command_attempt,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -create_or_delete_windows_shares_using_net_exe,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -unload_sysmon_filter_driver,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -resize_shadowstorage_volume,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -wmic_xsl_execution_via_url,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_reg_exe_process,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -etw_registry_disabled,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -process_execution_via_wmi,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -samsam_test_file_write,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" -impacket_lateral_movement_commandline_parameters,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -dump_lsass_via_comsvcs_dll,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -creation_of_shadow_copy_with_wmic_and_powershell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -overwriting_accessibility_binaries,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_ossec, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" -add_defaultuser_and_password_in_registry,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -bits_job_persistence,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_rundll32_dllregisterserver,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -any_powershell_downloadfile,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -mmc_exe_lolbas_execution_process_spawn,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -w3wp_spawning_shell,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -detect_sharphound_command_line_arguments,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" -detect_rclone_command_line_usage,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -suspicious_msbuild_path,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -disabling_net_user_account,5.0.0,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon -shim_database_installation_with_suspicious_parameters,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" -dns_query_length_with_high_standard_deviation,5.0.0,Splunk_TA_microsoft_sysmon,"Splunk_TA_isc-bind, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR, Splunk_TA_infoblox" +abnormally_high_number_of_cloud_security_group_api_calls,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" +cloud_api_calls_from_previously_unseen_user_roles,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, splunk_ta_o365, Splunk_TA_box, Splunk_TA_infoblox, Splunk_TA_salesforce" +cloud_compute_instance_created_in_previously_unused_region,5.0.1,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose +cloud_provisioning_from_previously_unseen_country,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" +cloud_compute_instance_created_by_previously_unseen_user,5.0.1,Splunk_TA_aws-kinesis-firehose,Splunk_TA_aws-kinesis-firehose +cloud_provisioning_from_previously_unseen_region,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" +abnormally_high_number_of_cloud_infrastructure_api_calls,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" +cloud_provisioning_from_previously_unseen_city,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce" +cloud_provisioning_from_previously_unseen_ip_address,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_salesforce" +cloud_instance_modified_with_previously_unseen_user,5.0.1,Splunk_TA_aws-kinesis-firehose,"Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_salesforce" +linux_setuid_using_chmod_utility,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +anomalous_usage_of_7zip,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +remcos_rat_file_creation_in_remcos_folder,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_ossec, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_cyberark, Splunk_TA_CrowdStrike_FDR" +enable_rdp_in_other_port_number,5.0.1,,Splunk_TA_bit9-carbonblack +excessive_number_of_taskhost_processes,5.0.1,Splunk_TA_windows,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +xsl_script_execution_with_wmic,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +rundll32_control_rundll_world_writable_directory,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disable_schedule_task,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +detect_excessive_account_lockouts_from_endpoint,5.0.1,Splunk_TA_windows,"Splunk_TA_microsoft-cloudservices, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_symantec-ep, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_box, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cisco-asa, Splunk_TA_salesforce" +serviceprincipalnames_discovery_with_setspn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_service_initiation_on_remote_endpoint,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +spoolsv_writing_a_dll,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +dsquery_domain_discovery,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +detect_azurehound_file_modifications,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +linux_possible_access_or_modification_of_sshd_config_file,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_file_without_extension_in_critical_folder,5.0.1,,Splunk_TA_bit9-carbonblack +secretdumps_offline_ntds_dumping_tool,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +attacker_tools_on_endpoint,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +domain_account_discovery_with_net_app,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +certutil_exe_certificate_extraction,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +detect_html_help_url_in_command_line,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +prevent_automatic_repair_mode_using_bcdedit,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_possible_access_to_sudoers_file,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +get_domainpolicy_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +excessive_number_of_distinct_processes_created_in_windows_temp_folder,5.0.1,Splunk_TA_windows,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" +powershell_disable_security_monitoring,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +svchost_exe_lolbas_execution_process_spawn,5.0.1,Splunk_TA_windows,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +windows_rasautou_dll_execution,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +certutil_download_with_verifyctl_and_split_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_nirsoft_advancedrun,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +cmd_echo_pipe___escalation,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +excessive_number_of_service_control_start_as_disabled,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +windows_installutil_url_in_command_line,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_use_of_cmd_exe_to_launch_script_interpreters,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +suspicious_icedid_rundll32_cmdline,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +excessive_service_stop_attempt,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_copy_on_system32,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +credential_dumping_via_symlink_to_shadow_copy,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_searchprotocolhost_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +excessive_usage_of_net_app,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +permission_modification_using_takeown_app,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_at_application_execution,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +reg_exe_manipulating_windows_services_registry_keys,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +logon_script_event_trigger_execution,5.0.1,,Splunk_TA_bit9-carbonblack +linux_possible_ssh_key_file_creation,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +dump_lsass_via_procdump,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_cyberark_epm" +getwmiobject_ds_computer_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +deleting_of_net_users,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_psexec_with_accepteula_flag,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +remote_process_instantiation_via_dcom_and_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +linux_doas_tool_execution,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +modify_acl_permission_to_files_or_folder,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +getdomaingroup_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +wermgr_process_spawned_cmd_or_powershell_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_azurehound_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +office_product_spawning_rundll32_with_no_dll,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +detect_exchange_web_shell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +system_processes_run_from_unexpected_locations,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +scheduled_task_initiation_on_remote_endpoint,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +sc_exe_manipulating_windows_services,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +ryuk_wake_on_lan_command,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +windows_remote_assistance_spawning_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_msbuild_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_possible_access_to_credential_files,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +suspicious_wevtutil_usage,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +excessive_usage_of_cacls_app,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +office_document_spawned_child_process_to_download,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +processes_launching_netsh,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_possible_append_command_to_at_allow_config_file,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +single_letter_process_on_endpoint,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" +check_elevated_cmd_using_whoami,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +short_lived_windows_accounts,5.0.1,,"Splunk_TA_microsoft-cloudservices, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_cyberark" +possible_lateral_movement_powershell_spawn,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +schtasks_scheduling_job_on_remote_system,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +executables_or_script_creation_in_suspicious_path,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR" +suspicious_rundll32_with_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +winword_spawning_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_regsvr32_register_suspicious_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_install_kernel_module_using_modprobe_utility,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +scheduled_task_creation_on_remote_endpoint_using_at,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_possible_append_command_to_profile_config_file,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +nishang_powershelltcponeline,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_mshta_url_in_command_line,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_sudoers_tmp_file_creation,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +suspicious_linux_discovery_commands,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +linux_service_restarted,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +getwmiobject_ds_group_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +firewall_allowed_program_enable,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +office_application_spawn_regsvr32_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_rundll32_inline_hta_execution,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_gpupdate_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +extraction_of_registry_hives,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +powershell_start_bitstransfer,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_mshta_spawn,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_rundll32_application_control_bypass___setupapi,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +recursive_delete_of_directory_in_batch_cmd,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +get_aduserresultantpasswordpolicy_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +windows_dotnet_binary_in_non_standard_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +net_profiler_uac_bypass,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +remote_process_instantiation_via_winrm_and_winrs,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +office_product_spawning_wmic,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +execution_of_file_with_multiple_extensions,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +remote_process_instantiation_via_winrm_and_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +suspicious_process_file_path,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +any_powershell_downloadstring,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_change_file_owner_to_root,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +process_creating_lnk_file_in_suspicious_location,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +wbadmin_delete_system_backups,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +linux_pkexec_privilege_escalation,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +attempt_to_stop_security_service,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +excel_spawning_powershell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_writes_to_windows_recycle_bin,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +getdomaincomputer_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +malicious_powershell_process___execution_policy_bypass,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +fodhelper_uac_bypass,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +detect_regsvr32_application_control_bypass,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_curl_download_to_suspicious_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_microsoft_workflow_compiler_usage,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +bcdedit_failure_recovery_modification,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +linux_service_file_created_in_systemd_directory,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +slui_runas_elevated,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +batch_file_write_to_system32,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +chcp_command_execution,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +excel_spawning_windows_script_host,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +windows_dism_remove_defender,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +excessive_usage_of_taskkill,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +nltest_domain_trust_discovery,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +fsutil_zeroing_file,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +office_application_spawn_rundll32_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +add_or_set_windows_defender_exclusion,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +bitsadmin_download_file,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_path_interception_by_creation_of_program_exe,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +cmdline_tool_not_executed_in_cmd_shell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_mshta_inline_hta_execution,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_rundll32_startw,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +script_execution_via_wmi,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +slui_spawning_a_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +scheduled_task_deleted_or_created_via_cmd,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +allow_network_discovery_in_firewall,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_file_created_in_kernel_driver_directory,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +disable_logs_using_wevtutil,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +revil_common_exec_parameter,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +detect_sharphound_usage,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +wmiprsve_exe_lolbas_execution_process_spawn,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +linux_file_creation_in_profile_directory,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +services_exe_lolbas_execution_process_spawn,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +regsvr32_with_known_silent_switch_cmdline,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +windows_installutil_uninstall_option,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +deleting_shadow_copies,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +winhlp32_spawning_a_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disabling_firewall_with_netsh,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +elevated_group_discovery_with_net,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +linux_setuid_using_setcap_utility,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_preload_hijack_library_calls,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +windows_installutil_in_non_standard_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +get_foresttrust_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_adfind_exe,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +msmpeng_application_dll_side_loading,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR" +account_discovery_with_net_app,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +linux_insert_kernel_module_using_insmod_utility,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +certutil_download_with_urlcache_and_split_arguments,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_msbuild_rename,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_mshta_child_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +set_default_powershell_execution_policy_to_unrestricted_or_bypass,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +uninstall_app_using_msiexec,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +execute_javascript_with_jscript_com_clsid,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +create_local_admin_accounts_using_net_exe,5.0.1,"Splunk_TA_microsoft_sysmon, Splunk_TA_windows","Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +linux_doas_conf_file_creation,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +creation_of_shadow_copy,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +linux_file_creation_in_init_boot_directory,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +getwmiobject_ds_user_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +dns_exfiltration_using_nslookup_app,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +detect_sharphound_file_modifications,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +clear_unallocated_sector_using_cipher_app,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_java_spawning_shell,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +remote_process_instantiation_via_wmi_and_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +detect_regsvcs_with_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +get_domaintrust_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +elevated_group_discovery_with_wmic,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +detect_rundll32_application_control_bypass___syssetup,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +ping_sleep_batch_command,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_system_network_discovery,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +detect_processes_used_for_system_network_configuration_discovery,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +clop_common_exec_parameter,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +office_product_spawning_certutil,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +regsvr32_silent_and_install_param_dll_loading,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +winword_spawning_windows_script_host,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +rubeus_command_line_parameters,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +msbuild_suspicious_spawned_by_script_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +hiding_files_and_directories_with_attrib_exe,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +office_product_spawn_cmd_process,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +certutil_with_decode_argument,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +allow_file_and_printing_sharing_in_firewall,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +system_information_discovery_detection,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +malicious_powershell_process_with_obfuscation_techniques,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_add_files_in_known_crontab_directories,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +icacls_deny_command,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +usn_journal_deletion,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +remote_system_discovery_with_wmic,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +detect_html_help_using_infotech_storage_handlers,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +sdelete_application_execution,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +curl_download_and_bash_execution,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +icacls_grant_command,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +rundll_loading_dll_by_ordinal,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +winword_spawning_cmd,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +credential_dumping_via_copy_command_from_shadow_copy,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_regasm_with_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +control_loading_from_world_writable_directory,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +remote_process_instantiation_via_wmi,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +ryuk_test_files_detected,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +suspicious_dllhost_no_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +spoolsv_spawning_rundll32,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +shim_database_file_creation,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_ossec, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR" +conti_common_exec_parameter,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +attempted_credential_dump_from_registry_via_reg_exe,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +jscript_execution_using_cscript_app,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +bcdedit_command_back_to_normal_mode_boot,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +rundll32_shimcache_flush,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +screensaver_event_trigger_execution,5.0.1,,Splunk_TA_bit9-carbonblack +office_product_spawning_bitsadmin,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +change_default_file_association,5.0.1,,Splunk_TA_bit9-carbonblack +wscript_or_cscript_suspicious_child_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +domain_controller_discovery_with_nltest,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +windows_security_account_manager_stopped,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm" +windows_curl_upload_to_remote_destination,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +unified_messaging_service_spawning_a_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +detect_html_help_spawn_child_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +detect_regsvcs_spawning_a_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +linux_service_started_or_enabled,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +java_class_file_download_by_java_user_agent,5.0.1,,"Splunk_TA_citrix-netscaler, Splunk_TA_nginx, Splunk_TA_microsoft-iis, Splunk_TA_websense-cg, Splunk_TA_squid, Splunk_TA_haproxy, Splunk_TA_mcafee-wg, Splunk_TA_cisco-wsa" +linux_at_allow_config_file_creation,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +linux_visudo_utility_execution,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +schtasks_run_task_on_demand,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +schtasks_used_for_forcing_a_reboot,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_raccine_scheduled_task_deletion,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +mshta_spawning_rundll32_or_regsvr32_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +mimikatz_passtheticket_commandline_parameters,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +excessive_attempt_to_disable_services,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +get_domainuser_with_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +suspicious_scheduled_task_from_public_directory,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +windows_service_creation_on_remote_endpoint,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +linux_nopasswd_entry_in_sudoers_file,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +attempt_to_add_certificate_to_untrusted_store,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +process_kill_base_on_file_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +wsmprovhost_exe_lolbas_execution_process_spawn,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +domain_account_discovery_with_wmic,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +linux_dd_file_overwrite,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +suspicious_rundll32_plugininit,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +file_with_samsam_extension,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +ntdsutil_export_ntds,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +vbscript_execution_using_wscript_app,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +office_spawning_control,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +detect_regasm_spawning_a_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +office_product_spawning_mshta,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +change_to_safe_mode_with_network_config,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +potentially_malicious_code_on_commandline,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +detect_rundll32_application_control_bypass___advpack,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +services_escalate_exe,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +wget_download_and_bash_execution,5.0.1,,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +remote_wmi_command_attempt,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +create_or_delete_windows_shares_using_net_exe,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +unload_sysmon_filter_driver,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +resize_shadowstorage_volume,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +wmic_xsl_execution_via_url,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_reg_exe_process,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +process_execution_via_wmi,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +samsam_test_file_write,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +impacket_lateral_movement_commandline_parameters,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_process_with_namedpipe_commandline,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +dump_lsass_via_comsvcs_dll,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_cyberark_epm" +creation_of_shadow_copy_with_wmic_and_powershell,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_microsoft_sysmon, Splunk_TA_cyberark_epm" +overwriting_accessibility_binaries,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +windows_schtasks_create_run_as_system,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +bits_job_persistence,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +suspicious_rundll32_dllregisterserver,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +any_powershell_downloadfile,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +mmc_exe_lolbas_execution_process_spawn,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +w3wp_spawning_shell,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +detect_sharphound_command_line_arguments,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +detect_rclone_command_line_usage,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +suspicious_msbuild_path,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +disabling_net_user_account,5.0.1,Splunk_TA_microsoft_sysmon,Splunk_TA_microsoft_sysmon +shim_database_installation_with_suspicious_parameters,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR" +office_application_drop_executable,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon" +windows_diskshadow_proxy_execution,5.0.1,Splunk_TA_microsoft_sysmon,"Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows" +dns_query_length_with_high_standard_deviation,5.0.1,,"Splunk_TA_isc-bind, Splunk_TA_CrowdStrike_FDR, Splunk_TA_infoblox" diff --git a/security_content_automation/detection_ta_mapping.yml b/security_content_automation/detection_ta_mapping.yml index ffb96a2eb7..8c93673bbf 100644 --- a/security_content_automation/detection_ta_mapping.yml +++ b/security_content_automation/detection_ta_mapping.yml @@ -1,5 +1,5 @@ abnormally_high_number_of_cloud_infrastructure_api_calls: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: @@ -17,7 +17,7 @@ abnormally_high_number_of_cloud_infrastructure_api_calls: - Splunk_TA_infoblox - Splunk_TA_salesforce abnormally_high_number_of_cloud_security_group_api_calls: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: @@ -35,78 +35,53 @@ abnormally_high_number_of_cloud_security_group_api_calls: - Splunk_TA_infoblox - Splunk_TA_salesforce account_discovery_with_net_app: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -active_setup_registry_autostart: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -add_defaultuser_and_password_in_registry: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows add_or_set_windows_defender_exclusion: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon allow_file_and_printing_sharing_in_firewall: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon -allow_inbound_traffic_by_firewall_rule_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon allow_network_discovery_in_firewall: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon -allow_operation_with_consent_admin: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon anomalous_usage_of_7zip: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows any_powershell_downloadfile: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon any_powershell_downloadstring: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon attacker_tools_on_endpoint: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -114,127 +89,138 @@ attacker_tools_on_endpoint: - Splunk_TA_microsoft_sysmon - Splunk_TA_windows attempt_to_add_certificate_to_untrusted_store: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows attempt_to_stop_security_service: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon attempted_credential_dump_from_registry_via_reg_exe: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon -auto_admin_logon_registry_entry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon batch_file_write_to_system32: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_nix - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR bcdedit_command_back_to_normal_mode_boot: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR bcdedit_failure_recovery_modification: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR bits_job_persistence: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon bitsadmin_download_file: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon certutil_download_with_urlcache_and_split_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon certutil_download_with_verifyctl_and_split_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon certutil_exe_certificate_extraction: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows certutil_with_decode_argument: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows change_default_file_association: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon change_to_safe_mode_with_network_config: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +chcp_command_execution: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows check_elevated_cmd_using_whoami: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows clear_unallocated_sector_using_cipher_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon clop_common_exec_parameter: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows cloud_api_calls_from_previously_unseen_user_roles: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: @@ -245,31 +231,19 @@ cloud_api_calls_from_previously_unseen_user_roles: - Splunk_TA_infoblox - Splunk_TA_salesforce cloud_compute_instance_created_by_previously_unseen_user: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: - Splunk_TA_aws-kinesis-firehose cloud_compute_instance_created_in_previously_unused_region: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_aws-kinesis-firehose - tas_with_cim_mapping: - - Splunk_TA_aws-kinesis-firehose -cloud_compute_instance_created_with_previously_unseen_image: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_aws-kinesis-firehose - tas_with_cim_mapping: - - Splunk_TA_aws-kinesis-firehose -cloud_compute_instance_created_with_previously_unseen_instance_type: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: - Splunk_TA_aws-kinesis-firehose cloud_instance_modified_with_previously_unseen_user: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: @@ -285,7 +259,7 @@ cloud_instance_modified_with_previously_unseen_user: - Splunk_TA_box - Splunk_TA_salesforce cloud_provisioning_from_previously_unseen_city: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: @@ -301,7 +275,7 @@ cloud_provisioning_from_previously_unseen_city: - Splunk_TA_infoblox - Splunk_TA_salesforce cloud_provisioning_from_previously_unseen_country: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: @@ -317,7 +291,7 @@ cloud_provisioning_from_previously_unseen_country: - Splunk_TA_infoblox - Splunk_TA_salesforce cloud_provisioning_from_previously_unseen_ip_address: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: @@ -331,7 +305,7 @@ cloud_provisioning_from_previously_unseen_ip_address: - Splunk_TA_box - Splunk_TA_salesforce cloud_provisioning_from_previously_unseen_region: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_aws-kinesis-firehose tas_with_cim_mapping: @@ -347,511 +321,447 @@ cloud_provisioning_from_previously_unseen_region: - Splunk_TA_infoblox - Splunk_TA_salesforce cmd_echo_pipe___escalation: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon cmdline_tool_not_executed_in_cmd_shell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon conti_common_exec_parameter: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon control_loading_from_world_writable_directory: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon create_local_admin_accounts_using_net_exe: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows create_or_delete_windows_shares_using_net_exe: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon creation_of_shadow_copy: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows creation_of_shadow_copy_with_wmic_and_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon + - Splunk_TA_cyberark_epm credential_dumping_via_copy_command_from_shadow_copy: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon credential_dumping_via_symlink_to_shadow_copy: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon curl_download_and_bash_execution: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR deleting_of_net_users: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon deleting_shadow_copies: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows detect_azurehound_command_line_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon -detect_exchange_web_shell: - cim_version: 5.0.0 + - Splunk_TA_windows +detect_azurehound_file_modifications: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR -detect_html_help_spawn_child_process: - cim_version: 5.0.0 +detect_excessive_account_lockouts_from_endpoint: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_windows + tas_with_cim_mapping: + - Splunk_TA_microsoft-cloudservices + - Splunk_TA_rsa-securid + - Splunk_TA_aws-kinesis-firehose + - Splunk_TA_rsa_securid_cas + - Splunk_TA_symantec-ep + - Splunk_TA_sophos + - Splunk_TA_cyberark + - Splunk_TA_windows + - Splunk_TA_box + - Splunk_TA_CrowdStrike_FDR + - Splunk_TA_cisco-asa + - Splunk_TA_salesforce +detect_exchange_web_shell: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_nix + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR +detect_html_help_spawn_child_process: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows detect_html_help_url_in_command_line: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_html_help_using_infotech_storage_handlers: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows detect_mshta_inline_hta_execution: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_mshta_url_in_command_line: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_path_interception_by_creation_of_program_exe: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR detect_processes_used_for_system_network_configuration_discovery: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows detect_psexec_with_accepteula_flag: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR detect_rclone_command_line_usage: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows detect_regasm_spawning_a_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows detect_regasm_with_no_command_line_arguments: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -detect_regsvcs_spawning_a_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon -detect_regsvcs_with_no_command_line_arguments: - cim_version: 5.0.0 + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +detect_regsvcs_spawning_a_process: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows +detect_regsvcs_with_no_command_line_arguments: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR detect_regsvr32_application_control_bypass: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_rundll32_application_control_bypass___advpack: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_rundll32_application_control_bypass___setupapi: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_rundll32_application_control_bypass___syssetup: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_rundll32_inline_hta_execution: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_sharphound_command_line_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows +detect_sharphound_file_modifications: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_CrowdStrike_FDR detect_sharphound_usage: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon detect_use_of_cmd_exe_to_launch_script_interpreters: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -disable_amsi_through_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -disable_defender_antivirus_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -disable_defender_blockatfirstseen_feature: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -disable_defender_enhanced_notification: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -disable_defender_mpengine_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -disable_defender_spynet_reporting: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -disable_defender_submit_samples_consent_feature: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -disable_etw_through_registry: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows disable_logs_using_wevtutil: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -disable_registry_tool: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon disable_schedule_task: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR -disable_security_logs_using_minint_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -disable_uac_remote_restriction: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -disable_windows_app_hotkeys: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -disable_windows_behavior_monitoring: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -disabling_cmd_application: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -disabling_controlpanel: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -disabling_defender_services: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows disabling_firewall_with_netsh: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon -disabling_folderoptions_windows_feature: - cim_version: 5.0.0 - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon disabling_net_user_account: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon -disabling_norun_windows_app: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -disabling_systemrestore_in_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -disabling_task_manager: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon dns_exfiltration_using_nslookup_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows dns_query_length_with_high_standard_deviation: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_isc-bind - - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR - Splunk_TA_infoblox domain_account_discovery_with_net_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows domain_account_discovery_with_wmic: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows domain_controller_discovery_with_nltest: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows dsquery_domain_discovery: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR + - Splunk_TA_windows dump_lsass_via_comsvcs_dll: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon + - Splunk_TA_cyberark_epm dump_lsass_via_procdump: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR + - Splunk_TA_cyberark_epm elevated_group_discovery_with_net: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows elevated_group_discovery_with_wmic: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows enable_rdp_in_other_port_number: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -enable_wdigest_uselogoncredential_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -etw_registry_disabled: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -eventvwr_uac_bypass: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon excel_spawning_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon -excessive_attempt_to_disable_services: - cim_version: 5.0.0 +excel_spawning_windows_script_host: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows +excessive_attempt_to_disable_services: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR excessive_number_of_distinct_processes_created_in_windows_temp_folder: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_windows tas_with_cim_mapping: - - Splunk_TA_nix - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR - Splunk_TA_cyberark_epm excessive_number_of_service_control_start_as_disabled: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows excessive_number_of_taskhost_processes: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_windows tas_with_cim_mapping: @@ -861,50 +771,49 @@ excessive_number_of_taskhost_processes: - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR excessive_service_stop_attempt: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon excessive_usage_of_cacls_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR + - Splunk_TA_windows excessive_usage_of_net_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon excessive_usage_of_taskkill: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR executables_or_script_creation_in_suspicious_path: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR execute_javascript_with_jscript_com_clsid: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows execution_of_file_with_multiple_extensions: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -912,13 +821,15 @@ execution_of_file_with_multiple_extensions: - Splunk_TA_microsoft_sysmon - Splunk_TA_windows extraction_of_registry_hives: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows file_with_samsam_extension: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -931,99 +842,113 @@ file_with_samsam_extension: - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR firewall_allowed_program_enable: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows fodhelper_uac_bypass: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows fsutil_zeroing_file: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows get_aduserresultantpasswordpolicy_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows get_domainpolicy_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows get_domaintrust_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR get_domainuser_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows get_foresttrust_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR getdomaincomputer_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows getdomaingroup_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows getwmiobject_ds_computer_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows getwmiobject_ds_group_with_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows getwmiobject_ds_user_with_powershell: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -hide_user_account_from_sign_in_screen: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows hiding_files_and_directories_with_attrib_exe: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -1031,29 +956,34 @@ hiding_files_and_directories_with_attrib_exe: - Splunk_TA_microsoft_sysmon - Splunk_TA_windows icacls_deny_command: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR icacls_grant_command: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR impacket_lateral_movement_commandline_parameters: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR java_class_file_download_by_java_user_agent: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_citrix-netscaler - Splunk_TA_nginx @@ -1064,314 +994,341 @@ java_class_file_download_by_java_user_agent: - Splunk_TA_mcafee-wg - Splunk_TA_cisco-wsa jscript_execution_using_cscript_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows linux_add_files_in_known_crontab_directories: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon linux_at_allow_config_file_creation: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon linux_at_application_execution: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_change_file_owner_to_root: - cim_version: 5.0.0 + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +linux_dd_file_overwrite: + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_doas_conf_file_creation: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon linux_doas_tool_execution: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_file_created_in_kernel_driver_directory: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon linux_file_creation_in_init_boot_directory: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon linux_file_creation_in_profile_directory: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon linux_insert_kernel_module_using_insmod_utility: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_install_kernel_module_using_modprobe_utility: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_java_spawning_shell: - cim_version: 5.0.0 - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -linux_nopasswd_entry_in_sudoers_file: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR -linux_pkexec_privilege_escalation: - cim_version: 5.0.0 - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -linux_possible_access_or_modification_of_sshd_config_file: - cim_version: 5.0.0 +linux_nopasswd_entry_in_sudoers_file: + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon +linux_pkexec_privilege_escalation: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +linux_possible_access_or_modification_of_sshd_config_file: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_possible_access_to_credential_files: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_possible_access_to_sudoers_file: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR linux_possible_append_command_to_at_allow_config_file: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_possible_append_command_to_profile_config_file: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_possible_ssh_key_file_creation: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon linux_preload_hijack_library_calls: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_service_file_created_in_systemd_directory: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon linux_service_restarted: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_service_started_or_enabled: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_setuid_using_chmod_utility: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_setuid_using_setcap_utility: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR linux_sudoers_tmp_file_creation: - cim_version: 5.0.0 + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +linux_system_network_discovery: + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon linux_visudo_utility_execution: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR logon_script_event_trigger_execution: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon malicious_powershell_process___execution_policy_bypass: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -malicious_powershell_process_with_obfuscation_techniques: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -mmc_exe_lolbas_execution_process_spawn: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -modify_acl_permission_to_files_or_folder: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +malicious_powershell_process_with_obfuscation_techniques: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +mimikatz_passtheticket_commandline_parameters: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows +mmc_exe_lolbas_execution_process_spawn: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows +modify_acl_permission_to_files_or_folder: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR msbuild_suspicious_spawned_by_script_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon mshta_spawning_rundll32_or_regsvr32_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon msmpeng_application_dll_side_loading: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR net_profiler_uac_bypass: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon nishang_powershelltcponeline: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon nltest_domain_trust_discovery: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows ntdsutil_export_ntds: - cim_version: 5.0.0 + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows +office_application_drop_executable: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon office_application_spawn_regsvr32_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_application_spawn_rundll32_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon office_document_spawned_child_process_to_download: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawn_cmd_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawning_bitsadmin: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawning_certutil: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawning_mshta: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_product_spawning_rundll32_with_no_dll: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows office_product_spawning_wmic: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon office_spawning_control: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows overwriting_accessibility_binaries: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_nix - - Splunk_TA_ossec - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - splunk_ta_o365 @@ -1380,214 +1337,242 @@ overwriting_accessibility_binaries: - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR permission_modification_using_takeown_app: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon ping_sleep_batch_command: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon possible_lateral_movement_powershell_spawn: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -potentially_malicious_code_on_commandline: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows +potentially_malicious_code_on_commandline: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR powershell_disable_security_monitoring: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon powershell_start_bitstransfer: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon prevent_automatic_repair_mode_using_bcdedit: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon -print_processor_registry_autostart: - cim_version: 5.0.0 - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon process_creating_lnk_file_in_suspicious_location: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR process_execution_via_wmi: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR + - Splunk_TA_windows process_kill_base_on_file_path: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon processes_launching_netsh: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon recursive_delete_of_directory_in_batch_cmd: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows reg_exe_manipulating_windows_services_registry_keys: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR -registry_keys_used_for_persistence: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon regsvr32_silent_and_install_param_dll_loading: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon regsvr32_with_known_silent_switch_cmdline: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon -remcos_client_registry_install_entry: - cim_version: 5.0.0 +remcos_rat_file_creation_in_remcos_folder: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_nix + - Splunk_TA_ossec + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_cyberark + - Splunk_TA_CrowdStrike_FDR remote_process_instantiation_via_dcom_and_powershell: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -remote_process_instantiation_via_winrm_and_powershell: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -remote_process_instantiation_via_winrm_and_winrs: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -remote_process_instantiation_via_wmi: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -remote_process_instantiation_via_wmi_and_powershell: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -remote_system_discovery_with_wmic: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -remote_wmi_command_attempt: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +remote_process_instantiation_via_winrm_and_powershell: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +remote_process_instantiation_via_winrm_and_winrs: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +remote_process_instantiation_via_wmi: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +remote_process_instantiation_via_wmi_and_powershell: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +remote_system_discovery_with_wmic: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows +remote_wmi_command_attempt: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows resize_shadowstorage_volume: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon revil_common_exec_parameter: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon -revil_registry_entry: - cim_version: 5.0.0 +rubeus_command_line_parameters: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows rundll32_control_rundll_world_writable_directory: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon rundll32_shimcache_flush: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon -rundll32_with_no_command_line_arguments_with_network: - cim_version: 5.0.0 +rundll_loading_dll_by_ordinal: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon +ryuk_test_files_detected: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_nix + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - splunk_ta_o365 + - Splunk_TA_sophos + - Splunk_TA_cyberark + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR ryuk_wake_on_lan_command: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows samsam_test_file_write: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -1600,144 +1585,139 @@ samsam_test_file_write: - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR sc_exe_manipulating_windows_services: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR scheduled_task_creation_on_remote_endpoint_using_at: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon scheduled_task_deleted_or_created_via_cmd: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows scheduled_task_initiation_on_remote_endpoint: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon schtasks_run_task_on_demand: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR -schtasks_scheduling_job_on_remote_system: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR -schtasks_used_for_forcing_a_reboot: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR -screensaver_event_trigger_execution: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -script_execution_via_wmi: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_nix - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR - - Splunk_TA_cyberark_epm -sdclt_uac_bypass: - cim_version: 5.0.0 +schtasks_scheduling_job_on_remote_system: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +schtasks_used_for_forcing_a_reboot: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +screensaver_event_trigger_execution: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +script_execution_via_wmi: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows sdelete_application_execution: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon secretdumps_offline_ntds_dumping_tool: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon serviceprincipalnames_discovery_with_setspn: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon services_escalate_exe: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows services_exe_lolbas_execution_process_spawn: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -set_default_powershell_execution_policy_to_unrestricted_or_bypass: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon -shim_database_installation_with_suspicious_parameters: - cim_version: 5.0.0 + - Splunk_TA_windows +set_default_powershell_execution_policy_to_unrestricted_or_bypass: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +shim_database_file_creation: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_nix + - Splunk_TA_ossec - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR +shim_database_installation_with_suspicious_parameters: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR short_lived_windows_accounts: - cim_version: 5.0.0 + cim_version: 5.0.1 tas_with_cim_mapping: - Splunk_TA_microsoft-cloudservices - Splunk_TA_rsa-securid - Splunk_TA_aws-kinesis-firehose - Splunk_TA_cyberark -silentcleanup_uac_bypass: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon single_letter_process_on_endpoint: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -1748,27 +1728,29 @@ single_letter_process_on_endpoint: - Splunk_TA_CrowdStrike_FDR - Splunk_TA_cyberark_epm slui_runas_elevated: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows slui_spawning_a_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows spoolsv_spawning_rundll32: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon spoolsv_writing_a_dll: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -1776,134 +1758,164 @@ spoolsv_writing_a_dll: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR -start_up_during_safe_mode_boot: - cim_version: 5.0.0 +suspicious_copy_on_system32: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon -suspicious_copy_on_system32: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR suspicious_dllhost_no_command_line_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR suspicious_gpupdate_no_command_line_arguments: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR suspicious_icedid_rundll32_cmdline: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows +suspicious_linux_discovery_commands: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR suspicious_microsoft_workflow_compiler_usage: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_msbuild_path: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_msbuild_rename: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_msbuild_spawn: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_mshta_child_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows suspicious_mshta_spawn: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_process_file_path: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows suspicious_reg_exe_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR suspicious_regsvr32_register_suspicious_path: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_rundll32_dllregisterserver: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_rundll32_plugininit: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_rundll32_startw: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon suspicious_rundll32_with_no_command_line_arguments: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -suspicious_scheduled_task_from_public_directory: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon -suspicious_searchprotocolhost_no_command_line_arguments: - cim_version: 5.0.0 + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +suspicious_scheduled_task_from_public_directory: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows +suspicious_searchprotocolhost_no_command_line_arguments: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR suspicious_wevtutil_usage: - cim_version: 5.0.0 + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +suspicious_writes_to_windows_recycle_bin: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -1911,11 +1923,198 @@ suspicious_wevtutil_usage: - Splunk_TA_microsoft_sysmon - Splunk_TA_CrowdStrike_FDR svchost_exe_lolbas_execution_process_spawn: - cim_version: 5.0.0 + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_windows + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows +system_information_discovery_detection: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +system_processes_run_from_unexpected_locations: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon +unified_messaging_service_spawning_a_process: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows +uninstall_app_using_msiexec: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows +unload_sysmon_filter_driver: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +usn_journal_deletion: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows +vbscript_execution_using_wscript_app: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows +w3wp_spawning_shell: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon -system_information_discovery_detection: - cim_version: 5.0.0 +wbadmin_delete_system_backups: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +wermgr_process_spawned_cmd_or_powershell_process: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +wget_download_and_bash_execution: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows + - Splunk_TA_CrowdStrike_FDR +windows_adfind_exe: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows +windows_curl_download_to_suspicious_path: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_curl_upload_to_remote_destination: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_diskshadow_proxy_execution: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows +windows_dism_remove_defender: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_dotnet_binary_in_non_standard_path: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_file_without_extension_in_critical_folder: + cim_version: 5.0.1 + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack +windows_installutil_in_non_standard_path: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_installutil_uninstall_option: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_installutil_url_in_command_line: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_nirsoft_advancedrun: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_process_with_namedpipe_commandline: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_raccine_scheduled_task_deletion: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_rasautou_dll_execution: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_remote_assistance_spawning_process: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_schtasks_create_run_as_system: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_microsoft_sysmon +windows_security_account_manager_stopped: + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: @@ -1925,226 +2124,79 @@ system_information_discovery_detection: - Splunk_TA_windows - Splunk_TA_CrowdStrike_FDR - Splunk_TA_cyberark_epm -system_processes_run_from_unexpected_locations: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR -time_provider_persistence_registry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -unified_messaging_service_spawning_a_process: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -uninstall_app_using_msiexec: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -unload_sysmon_filter_driver: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR -usn_journal_deletion: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -vbscript_execution_using_wscript_app: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -w3wp_spawning_shell: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -wbadmin_delete_system_backups: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon - - Splunk_TA_CrowdStrike_FDR -wermgr_process_spawned_cmd_or_powershell_process: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -wget_download_and_bash_execution: - cim_version: 5.0.0 - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -windows_adfind_exe: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -windows_curl_download_to_suspicious_path: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -windows_curl_upload_to_remote_destination: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -windows_defender_exclusion_registry_entry: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -windows_disableantispyware_reg: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_bit9-carbonblack - - Splunk_TA_microsoft_sysmon -windows_dism_remove_defender: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -windows_dotnet_binary_in_non_standard_path: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -windows_installutil_credential_theft: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -windows_installutil_in_non_standard_path: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -windows_installutil_uninstall_option: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -windows_installutil_url_in_command_line: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -windows_nirsoft_advancedrun: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -windows_raccine_scheduled_task_deletion: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon windows_service_creation_on_remote_endpoint: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon windows_service_initiation_on_remote_endpoint: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon winhlp32_spawning_a_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon winword_spawning_cmd: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon winword_spawning_powershell: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon +winword_spawning_windows_script_host: + cim_version: 5.0.1 + supported_tas: + - Splunk_TA_microsoft_sysmon + tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack + - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows wmic_xsl_execution_via_url: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_microsoft_sysmon wmiprsve_exe_lolbas_execution_process_spawn: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows wscript_or_cscript_suspicious_child_process: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: + - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows wsmprovhost_exe_lolbas_execution_process_spawn: - cim_version: 5.0.0 - supported_tas: - - Splunk_TA_microsoft_sysmon - tas_with_cim_mapping: - - Splunk_TA_microsoft_sysmon -wsreset_uac_bypass: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows xsl_script_execution_with_wmic: - cim_version: 5.0.0 + cim_version: 5.0.1 supported_tas: - Splunk_TA_microsoft_sysmon tas_with_cim_mapping: - Splunk_TA_bit9-carbonblack - Splunk_TA_microsoft_sysmon + - Splunk_TA_windows