diff --git a/bin/generate.py b/bin/generate.py index 7e101fe51f..18150c250e 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -639,7 +639,8 @@ def main(REPO_PATH, OUTPUT_PATH, VERBOSE): baselines = sorted(baselines, key=lambda b: b['name']) detection_path = generate_savedsearches_conf(detections, response_tasks, baselines, deployments, TEMPLATE_PATH, OUTPUT_PATH) - stories = sorted(stories, key=lambda s: s['name']) + # only use ESCU stories to the configuration + stories = sorted(filter(lambda s: s['type'].lower() == 'batch', stories), key=lambda s: s['name']) story_path = generate_analytic_story_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH) use_case_lib_path = generate_use_case_library_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH) diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml index d1ccf15d46..1e23fa4153 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml @@ -25,6 +25,8 @@ references: - https://github.com/gentilkiwi/mimikatz - https://adsecurity.org/?p=1275 tags: + analytic_story: + - Credential Dumping asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml index 9f974415ef..963a265bf8 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml @@ -27,6 +27,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Credential Dumping asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml index 1928fadc18..ac791a6cf3 100644 --- a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml @@ -22,6 +22,8 @@ known_false_positives: None identified. references: - https://github.com/MichaelGrafnetter/DSInternals tags: + analytic_story: + - Credential Dumping asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml index d82fa48fa4..a6d2730dd1 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml @@ -33,6 +33,9 @@ known_false_positives: None identified. references: - https://github.com/MichaelGrafnetter/DSInternals tags: + analytic_story: + - Credential Dumping + - Malicious PowerShell asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml index 86b949a084..d3f0500b51 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml @@ -34,6 +34,9 @@ known_false_positives: None identified. references: - https://github.com/MichaelGrafnetter/DSInternals tags: + analytic_story: + - Credential Dumping + - Malicious PowerShell asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml index 00e4b807dc..2f5e7fd457 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml @@ -30,6 +30,9 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in known_false_positives: None identified. references: [] tags: + analytic_story: + - Unusual Processes + - Credential Dumping asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml index 3e08c94dc1..07f1ebdfd0 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml @@ -28,6 +28,9 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in known_false_positives: None identified. references: [] tags: + analytic_story: + - Unusual Processes + - Credential Dumping asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml index a222d99b91..8cef206729 100644 --- a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml +++ b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml @@ -26,6 +26,9 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in known_false_positives: None identified. references: [] tags: + analytic_story: + - Credential Dumping + - Malicious PowerShell asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml index 0b3a3a9d9e..1f0cb6e6f3 100644 --- a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml +++ b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml @@ -24,6 +24,8 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in known_false_positives: None identified. references: [] tags: + analytic_story: + - Credential Dumping asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml index 6274d7e2e1..5da09d9975 100644 --- a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml @@ -29,6 +29,9 @@ known_false_positives: None identified. references: - https://github.com/gentilkiwi/mimikatz tags: + analytic_story: + - Credential Dumping + - Unusual Processes asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml index 61fa6bb1da..8c9f8eaef1 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml @@ -33,6 +33,9 @@ known_false_positives: Although unlikely, using debuggers this way may be indica references: - https://medium.com/@clermont1050/covid-19-cyber-infection-c615ead7c29 tags: + analytic_story: + - Credential Dumping + - Unusual Processes asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml index 4f07f8c212..5623c57620 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml @@ -29,6 +29,9 @@ known_false_positives: Although unlikely, using debuggers this way may be indica code, not analyze its crash dumps. references: [] tags: + analytic_story: + - Credential Dumping + - Unusual Processes asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml index cf0da21ba4..282d265440 100644 --- a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml @@ -30,6 +30,9 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Credential Dumping + - Malicious PowerShell asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___detect_kerberoasting.yml b/detections/endpoint/ssa___detect_kerberoasting.yml index 5c68d026ec..b16907613e 100644 --- a/detections/endpoint/ssa___detect_kerberoasting.yml +++ b/detections/endpoint/ssa___detect_kerberoasting.yml @@ -23,6 +23,8 @@ known_false_positives: Older systems that support kerberos RC4 by default NetApp references: - Initial ESCU implementation by Jose Hernandez and Patrick Bareiss tags: + analytic_story: + - Credential Dumping cis20: - CIS 8 - CIS 16 diff --git a/detections/endpoint/ssa___detect_pass_hash.yml b/detections/endpoint/ssa___detect_pass_hash.yml index c454713d1e..e020e8e71d 100644 --- a/detections/endpoint/ssa___detect_pass_hash.yml +++ b/detections/endpoint/ssa___detect_pass_hash.yml @@ -23,6 +23,8 @@ known_false_positives: Legitimate logon activity by authorized NTLM systems may references: - Initial ESCU implementation by Bhavin Patel and Patrick Bareiss tags: + analytic_story: + - Lateral Movement cis20: - CIS 3 - CIS 5 diff --git a/detections/endpoint/ssa___first_time_seen_cmd_line.yml b/detections/endpoint/ssa___first_time_seen_cmd_line.yml index 86ef3bd37e..8a904421ad 100644 --- a/detections/endpoint/ssa___first_time_seen_cmd_line.yml +++ b/detections/endpoint/ssa___first_time_seen_cmd_line.yml @@ -31,6 +31,8 @@ known_false_positives: Legitimate programs can also use command-line arguments t macro to exclude legitimate parent_process_name references: [] tags: + analytic_story: + - Unusual Processes cis20: - CIS 3 - CIS 8 diff --git a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml index be9e3b0b5e..5580c62c12 100644 --- a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml @@ -27,6 +27,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Malicious PowerShell asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml index 430cdbb55c..269743b401 100644 --- a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml @@ -22,6 +22,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml index 404792b0d6..67cc8de51e 100644 --- a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml @@ -23,6 +23,8 @@ known_false_positives: None identified. references: - https://github.com/MichaelGrafnetter/DSInternals tags: + analytic_story: + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml index 931fe9a772..4e7cb685d2 100644 --- a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml @@ -23,6 +23,8 @@ known_false_positives: None identified. references: - https://github.com/gentilkiwi/mimikatz tags: + analytic_story: + - Windows Log Manipulation asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml index 3f8e41c049..e098909b48 100644 --- a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml @@ -25,6 +25,8 @@ known_false_positives: None identified. references: - https://github.com/MichaelGrafnetter/DSInternals tags: + analytic_story: + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml index 35b596f0e2..da936961b2 100644 --- a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml @@ -26,6 +26,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml index c9da9c4920..8a1f6efa4f 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml @@ -26,6 +26,9 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Malicious PowerShell + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml index 5fd9a1b63f..f8866fe4e3 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml @@ -23,6 +23,8 @@ known_false_positives: None identified. references: - https://github.com/gentilkiwi/mimikatz tags: + analytic_story: + - Windows Privilege Escalation asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml index 8591a598a3..6f65269372 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml @@ -26,6 +26,8 @@ known_false_positives: None identified. references: - https://github.com/gentilkiwi/mimikatz tags: + analytic_story: + - Windows Service Abuse asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml index e22181cdd4..bcf8a79093 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml @@ -34,6 +34,9 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Service Abuse + - Malicious PowerShell asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml index 533125e359..78d8fe4cca 100644 --- a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml @@ -24,6 +24,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Privilege Escalation asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index b95526d78d..be323b6aed 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -32,6 +32,11 @@ known_false_positives: There are circumstances where an application may legitima the lookup file, as appropriate. references: [] tags: + analytic_story: + - Suspicious Command-Line Executions + - Suspicious MSHTA Activity + - Suspicious Zoom Child Processes + - Sunburst Malware cis20: - CIS 8 kill_chain_phases: diff --git a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml index 1c77e8e1a6..c06bf90ffe 100644 --- a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml +++ b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml @@ -56,6 +56,8 @@ known_false_positives: 'Some custom tools used by admins could be used rarely to ' references: [] tags: + analytic_story: + - Unusual Processes cis20: - CIS 8 kill_chain_phases: diff --git a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml index 0b7719dba9..ccd1366fc5 100644 --- a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml @@ -35,6 +35,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml index 231ab0a12c..e4909636d9 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml @@ -44,6 +44,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml index 734b7f6ffa..bc2414280b 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml @@ -23,6 +23,8 @@ known_false_positives: None identified. references: - https://github.com/gentilkiwi/mimikatz tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml index c690611bab..5a1dc87a99 100644 --- a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml @@ -34,6 +34,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml index 8d367a6176..c4965bde6d 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml @@ -27,6 +27,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml index b560b3e926..524c41dbee 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml @@ -22,6 +22,8 @@ known_false_positives: None identified. references: - https://github.com/gentilkiwi/mimikatz tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml index 322a14cd76..c38b8ec4f4 100644 --- a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml @@ -29,6 +29,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml index 0531d79905..52b742344c 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml @@ -22,6 +22,8 @@ known_false_positives: None identified. references: - https://github.com/gentilkiwi/mimikatz tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml index 014a52e628..440b14a3fc 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml @@ -27,6 +27,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml index 00376d8266..f5ec31ffd3 100644 --- a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml @@ -28,6 +28,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml index e68d1bbf83..59ca2ded68 100644 --- a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml @@ -25,6 +25,8 @@ known_false_positives: None identified. references: - https://github.com/gentilkiwi/mimikatz tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml index 3144c0201a..cbf2f7434a 100644 --- a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml @@ -22,6 +22,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml index 2b23aa38ef..4d02192a44 100644 --- a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml @@ -22,6 +22,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml index a2bfc5c823..44341325ec 100644 --- a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml @@ -27,6 +27,8 @@ references: - https://github.com/gentilkiwi/mimikatz - https://en.wikipedia.org/wiki/Microsoft_Detours tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml index d388dc0620..af50324fcb 100644 --- a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml @@ -23,6 +23,8 @@ known_false_positives: None identified. references: - https://github.com/gentilkiwi/mimikatz tags: + analytic_story: + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml index a08c8abbb3..6efa006092 100644 --- a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml @@ -28,6 +28,8 @@ known_false_positives: None identified. references: - https://github.com/MichaelGrafnetter/DSInternals tags: + analytic_story: + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml index 86e43a4e2a..24a53a89d5 100644 --- a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml @@ -23,6 +23,8 @@ known_false_positives: None identified. references: - https://github.com/gentilkiwi/mimikatz tags: + analytic_story: + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml index 62f9e7a824..75c22c3bb5 100644 --- a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml @@ -22,6 +22,8 @@ known_false_positives: None identified. references: - https://github.com/PowerShellMafia/PowerSploit tags: + analytic_story: + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___system_process_running_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_unexpected_location.yml index 00a043d53a..c1643f6dbd 100644 --- a/detections/endpoint/ssa___system_process_running_unexpected_location.yml +++ b/detections/endpoint/ssa___system_process_running_unexpected_location.yml @@ -231,6 +231,8 @@ how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: None references: [] tags: + analytic_story: + - Windows Defense Evasion Tactics cis20: - CIS 8 kill_chain_phases: diff --git a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml index 3f2f33ae95..d273cdbfd8 100644 --- a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml +++ b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml @@ -50,6 +50,8 @@ known_false_positives: 'Some administrative tasks may involve multiple use of LO references: - https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries tags: + analytic_story: + - Unusual Processes cis20: - CIS 8 kill_chain_phases: diff --git a/detections/endpoint/ssa___unusually_long_command_line.yml b/detections/endpoint/ssa___unusually_long_command_line.yml index 6a8e87d1ff..867cb6abcb 100644 --- a/detections/endpoint/ssa___unusually_long_command_line.yml +++ b/detections/endpoint/ssa___unusually_long_command_line.yml @@ -33,6 +33,8 @@ known_false_positives: This detection may flag suspiciously long command lines w Attackers may use this technique to obfuscate their payloads. references: [] tags: + analytic_story: + - Unusual Processes cis20: - CIS 8 kill_chain_phases: diff --git a/stories/windows_discovery_techniques.yml b/stories/windows_discovery_techniques.yml new file mode 100644 index 0000000000..8320b3903d --- /dev/null +++ b/stories/windows_discovery_techniques.yml @@ -0,0 +1,25 @@ +name: Windows Discovery Techniques +id: f7aba570-7d59-11eb-825e-acde48001122 +version: 1 +date: '2021-03-04' +author: Michael Hart, Splunk +type: streaming +description: Monitors for behaviors associated with adversaries discovering objects in the + environment that can be leveraged in the progression of the attack. +narrative: Attackers may not have much if any insight into their target's environment + before the initial compromise. Once a foothold has been established, attackers will + start enumerating objects in the environment (accounts, services, network shares, etc.) + that can be used to achieve their objectives. This Analytic Story provides searches to + help identify activities consistent with adversaries gaining knowledge of compromised + Windows environments. +references: + - https://attack.mitre.org/tactics/TA0007/ + - https://cyberd.us/penetration-testing +tags: + analytic_story: + - Windows Discovery Techniques + category: + - Adversary Tactics + product: + - UEBA for Security Cloud + usecase: Advanced Threat Detection