Branch was auto-updated.

bin/generate.py

@@ -639,7 +639,8 @@ def main(REPO_PATH, OUTPUT_PATH, VERBOSE):
     baselines = sorted(baselines, key=lambda b: b['name'])
     detection_path = generate_savedsearches_conf(detections, response_tasks, baselines, deployments, TEMPLATE_PATH, OUTPUT_PATH)
 
-    stories = sorted(stories, key=lambda s: s['name'])
+    # only use ESCU stories to the configuration
+    stories = sorted(filter(lambda s: s['type'].lower() == 'batch', stories), key=lambda s: s['name'])
     story_path = generate_analytic_story_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH)
 
     use_case_lib_path = generate_use_case_library_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH)

detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml

@@ -25,6 +25,8 @@ references:
 - https://github.com/gentilkiwi/mimikatz
 - https://adsecurity.org/?p=1275
 tags:
+  analytic_story:
+    - Credential Dumping
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml

@@ -27,6 +27,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/PowerShellMafia/PowerSploit
 tags:
+  analytic_story:
+    - Credential Dumping
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml

@@ -22,6 +22,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/MichaelGrafnetter/DSInternals
 tags:
+  analytic_story:
+    - Credential Dumping
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml

@@ -33,6 +33,9 @@ known_false_positives: None identified.
 references:
 - https://github.com/MichaelGrafnetter/DSInternals
 tags:
+  analytic_story:
+    - Credential Dumping
+    - Malicious PowerShell
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml

@@ -34,6 +34,9 @@ known_false_positives: None identified.
 references:
 - https://github.com/MichaelGrafnetter/DSInternals
 tags:
+  analytic_story:
+    - Credential Dumping
+    - Malicious PowerShell
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml

@@ -30,6 +30,9 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
 known_false_positives: None identified.
 references: []
 tags:
+  analytic_story:
+    - Unusual Processes
+    - Credential Dumping
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml

@@ -28,6 +28,9 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
 known_false_positives: None identified.
 references: []
 tags:
+  analytic_story:
+    - Unusual Processes
+    - Credential Dumping
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml

@@ -26,6 +26,9 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
 known_false_positives: None identified.
 references: []
 tags:
+  analytic_story:
+    - Credential Dumping
+    - Malicious PowerShell
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml

@@ -24,6 +24,8 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
 known_false_positives: None identified.
 references: []
 tags:
+  analytic_story:
+    - Credential Dumping
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml

@@ -29,6 +29,9 @@ known_false_positives: None identified.
 references:
 - https://github.com/gentilkiwi/mimikatz
 tags:
+  analytic_story:
+    - Credential Dumping
+    - Unusual Processes
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml

@@ -33,6 +33,9 @@ known_false_positives: Although unlikely, using debuggers this way may be indica
 references:
 - https://medium.com/@clermont1050/covid-19-cyber-infection-c615ead7c29
 tags:
+  analytic_story:
+    - Credential Dumping
+    - Unusual Processes
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml

@@ -29,6 +29,9 @@ known_false_positives: Although unlikely, using debuggers this way may be indica
   code, not analyze its crash dumps.
 references: []
 tags:
+  analytic_story:
+    - Credential Dumping
+    - Unusual Processes
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___credential_extraction_powersploit_modules.yml

@@ -30,6 +30,9 @@ known_false_positives: None identified.
 references:
 - https://github.com/PowerShellMafia/PowerSploit
 tags:
+  analytic_story:
+    - Credential Dumping
+    - Malicious PowerShell
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___detect_kerberoasting.yml

@@ -23,6 +23,8 @@ known_false_positives: Older systems that support kerberos RC4 by default NetApp
 references:
 - Initial ESCU implementation by Jose Hernandez and Patrick Bareiss
 tags:
+  analytic_story:
+  - Credential Dumping
   cis20:
   - CIS 8
   - CIS 16

detections/endpoint/ssa___detect_pass_hash.yml

@@ -23,6 +23,8 @@ known_false_positives: Legitimate logon activity by authorized NTLM systems may
 references:
 - Initial ESCU implementation by Bhavin Patel and Patrick Bareiss
 tags:
+  analytic_story:
+    - Lateral Movement
   cis20:
   - CIS 3
   - CIS 5

detections/endpoint/ssa___first_time_seen_cmd_line.yml

@@ -31,6 +31,8 @@ known_false_positives: Legitimate programs can also use command-line arguments t
   macro to exclude legitimate parent_process_name
 references: []
 tags:
+  analytic_story:
+    - Unusual Processes
   cis20:
   - CIS 3
   - CIS 8

detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml

@@ -27,6 +27,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/PowerShellMafia/PowerSploit
 tags:
+  analytic_story:
+    - Malicious PowerShell
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml

@@ -22,6 +22,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/PowerShellMafia/PowerSploit
 tags:
+  analytic_story:
+    - Windows Persistence Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml

@@ -23,6 +23,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/MichaelGrafnetter/DSInternals
 tags:
+  analytic_story:
+    - Windows Persistence Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml

@@ -23,6 +23,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/gentilkiwi/mimikatz
 tags:
+  analytic_story:
+    - Windows Log Manipulation
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml

@@ -25,6 +25,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/MichaelGrafnetter/DSInternals
 tags:
+  analytic_story:
+    - Windows Persistence Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml

@@ -26,6 +26,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/PowerShellMafia/PowerSploit
 tags:
+  analytic_story:
+    - Windows Persistence Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml

@@ -26,6 +26,9 @@ known_false_positives: None identified.
 references:
 - https://github.com/PowerShellMafia/PowerSploit
 tags:
+  analytic_story:
+    - Malicious PowerShell
+    - Windows Persistence Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml

@@ -23,6 +23,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/gentilkiwi/mimikatz
 tags:
+  analytic_story:
+    - Windows Privilege Escalation
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml

@@ -26,6 +26,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/gentilkiwi/mimikatz
 tags:
+  analytic_story:
+    - Windows Service Abuse
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml

@@ -34,6 +34,9 @@ known_false_positives: None identified.
 references:
 - https://github.com/PowerShellMafia/PowerSploit
 tags:
+  analytic_story:
+    - Windows Service Abuse
+    - Malicious PowerShell
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml

@@ -24,6 +24,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/PowerShellMafia/PowerSploit
 tags:
+  analytic_story:
+    - Windows Privilege Escalation
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml

@@ -32,6 +32,11 @@ known_false_positives: There are circumstances where an application may legitima
   the lookup file, as appropriate.
 references: []
 tags:
+  analytic_story:
+    - Suspicious Command-Line Executions
+    - Suspicious MSHTA Activity
+    - Suspicious Zoom Child Processes
+    - Sunburst Malware
   cis20:
   - CIS 8
   kill_chain_phases:

detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml

@@ -56,6 +56,8 @@ known_false_positives: 'Some custom tools used by admins could be used rarely to
   '
 references: []
 tags:
+  analytic_story:
+    - Unusual Processes
   cis20:
   - CIS 8
   kill_chain_phases:

detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml

@@ -35,6 +35,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/PowerShellMafia/PowerSploit
 tags:
+  analytic_story:
+    - Windows Discovery Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml

@@ -44,6 +44,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/PowerShellMafia/PowerSploit
 tags:
+  analytic_story:
+    - Windows Discovery Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml

@@ -23,6 +23,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/gentilkiwi/mimikatz
 tags:
+  analytic_story:
+    - Windows Discovery Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml

@@ -34,6 +34,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/PowerShellMafia/PowerSploit
 tags:
+  analytic_story:
+    - Windows Discovery Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml

@@ -27,6 +27,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/PowerShellMafia/PowerSploit
 tags:
+  analytic_story:
+    - Windows Discovery Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml

@@ -22,6 +22,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/gentilkiwi/mimikatz
 tags:
+  analytic_story:
+    - Windows Discovery Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml

@@ -29,6 +29,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/PowerShellMafia/PowerSploit
 tags:
+  analytic_story:
+    - Windows Discovery Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml

@@ -22,6 +22,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/gentilkiwi/mimikatz
 tags:
+  analytic_story:
+    - Windows Discovery Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml

@@ -27,6 +27,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/PowerShellMafia/PowerSploit
 tags:
+  analytic_story:
+    - Windows Discovery Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml

@@ -28,6 +28,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/PowerShellMafia/PowerSploit
 tags:
+  analytic_story:
+    - Windows Discovery Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml

@@ -25,6 +25,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/gentilkiwi/mimikatz
 tags:
+  analytic_story:
+    - Windows Discovery Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml

@@ -22,6 +22,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/PowerShellMafia/PowerSploit
 tags:
+  analytic_story:
+    - Windows Discovery Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml

@@ -22,6 +22,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/PowerShellMafia/PowerSploit
 tags:
+  analytic_story:
+    - Windows Discovery Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml

@@ -27,6 +27,8 @@ references:
 - https://github.com/gentilkiwi/mimikatz
 - https://en.wikipedia.org/wiki/Microsoft_Detours
 tags:
+  analytic_story:
+    - Windows Discovery Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml

@@ -23,6 +23,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/gentilkiwi/mimikatz
 tags:
+  analytic_story:
+    - Windows Discovery Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml

@@ -28,6 +28,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/MichaelGrafnetter/DSInternals
 tags:
+  analytic_story:
+    - Windows Persistence Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml

@@ -23,6 +23,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/gentilkiwi/mimikatz
 tags:
+  analytic_story:
+    - Windows Persistence Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml

@@ -22,6 +22,8 @@ known_false_positives: None identified.
 references:
 - https://github.com/PowerShellMafia/PowerSploit
 tags:
+  analytic_story:
+    - Windows Persistence Techniques
   asset_type: Windows
   cis20:
   - CIS 16

detections/endpoint/ssa___system_process_running_unexpected_location.yml

@@ -231,6 +231,8 @@ how_to_implement: Collect endpoint data such as sysmon or 4688 events.
 known_false_positives: None
 references: []
 tags:
+  analytic_story:
+    - Windows Defense Evasion Tactics
   cis20:
   - CIS 8
   kill_chain_phases:

detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml

@@ -50,6 +50,8 @@ known_false_positives: 'Some administrative tasks may involve multiple use of LO
 references:
 - https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
 tags:
+  analytic_story:
+    - Unusual Processes
   cis20:
   - CIS 8
   kill_chain_phases:

detections/endpoint/ssa___unusually_long_command_line.yml

@@ -33,6 +33,8 @@ known_false_positives: This detection may flag suspiciously long command lines w
   Attackers may use this technique to obfuscate their payloads.
 references: []
 tags:
+  analytic_story:
+    - Unusual Processes
   cis20:
   - CIS 8
   kill_chain_phases:

stories/windows_discovery_techniques.yml

@@ -0,0 +1,25 @@
+name: Windows Discovery Techniques
+id: f7aba570-7d59-11eb-825e-acde48001122
+version: 1
+date: '2021-03-04'
+author: Michael Hart, Splunk
+type: streaming
+description: Monitors for behaviors associated with adversaries discovering objects in the
+  environment that can be leveraged in the progression of the attack.
+narrative: Attackers may not have much if any insight into their target's environment
+  before the initial compromise.  Once a foothold has been established, attackers will
+  start enumerating objects in the environment (accounts, services, network shares, etc.)
+  that can be used to achieve their objectives.  This Analytic Story provides searches to
+  help identify activities consistent with adversaries gaining knowledge of compromised
+  Windows environments.
+references:
+  - https://attack.mitre.org/tactics/TA0007/
+  - https://cyberd.us/penetration-testing
+tags:
+  analytic_story:
+    - Windows Discovery Techniques
+  category:
+    - Adversary Tactics
+  product:
+    - UEBA for Security Cloud
+  usecase: Advanced Threat Detection