From 3eaf538fe8558a617e15fc5453d39ff89404b343 Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 15 May 2019 14:06:09 -0700 Subject: [PATCH 1/2] removing duplicate is_visible and local-true from commands.conf --- bin/generate.py | 1 - src/default/commands.conf | 3 +-- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index a86fd27670..ca68b72978 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -971,7 +971,6 @@ def write_savedsearches_confv1(stories, detections, investigations, baselines, O output_file.write("alert.suppress.period = {0}\n" .format(detection['correlation_rule']['suppress']['suppress_period'])) - output_file.write("is_visible = false\n") output_file.write("action.escu.earliest_time_offset = 3600\n") output_file.write("action.escu.latest_time_offset = 86400\n") output_file.write("disabled=true\n") diff --git a/src/default/commands.conf b/src/default/commands.conf index e4ae05b4bb..69e62d5eb8 100644 --- a/src/default/commands.conf +++ b/src/default/commands.conf @@ -5,5 +5,4 @@ chunked = true [runstory] filename = runstory.py chunked = true -is_risky = true -local = true +is_risky = true \ No newline at end of file From e4e88a53b401e924580894236fd585a91c74e83d Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 15 May 2019 14:12:35 -0700 Subject: [PATCH 2/2] src files --- src/default/analytic_stories.conf | 18 +- src/default/savedsearches.conf | 295 +++++++----------------------- src/default/use_case_library.conf | 104 +++++------ 3 files changed, 129 insertions(+), 288 deletions(-) diff --git a/src/default/analytic_stories.conf b/src/default/analytic_stories.conf index 0da494bdcc..2bb468ceec 100644 --- a/src/default/analytic_stories.conf +++ b/src/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security-content -# On Date: 2019-05-15T20:03:38 UTC +# On Date: 2019-05-15T21:12:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -232,7 +232,7 @@ investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - support_searches = [] data_models = ["Authentication", "Endpoint", "Network_Traffic", "Risk"] providing_technologies = ["Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] -description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. +description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. narrative = A common adversary goal is to identify and exfiltrate data of value from a target organization. This data may include email conversations and addresses, confidential company information, links to network design/infrastructure, important dates, and so on.\ \ Attacks are composed of three activities: identification, collection, and staging data for exfiltration. Identification typically involves scanning systems and observing user activity. Collection can involve the transfer of large amounts of data from various repositories. Staging/preparation includes moving data to a central location and compressing (and optionally encoding and/or encrypting) it. All of these activities provide opportunities for defenders to identify their presence. \ @@ -270,7 +270,7 @@ investigative_searches = ["ESCU - Get Certificate logs for a domain"] support_searches = [] data_models = ["Certificates", "Network_Resolution", "Web"] providing_technologies = ["Bro", "Censys", "Splunk Stream"] -description = Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email. +description = Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email. narrative = As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Because phishing is a technique that relies on human psychology, you will never be able to eliminate this vulnerability 100%. But you can use automated detection to significantly reduce the risks.\ \ This Analytic Story focuses on detecting signs of MiTM attacks enabled by [EvilGinx2](https://github.com/kgretzky/evilginx2), a toolkit that sets up a transparent proxy between the targeted site and the user. In this way, the attacker is able to intercept credentials and two-factor identification tokens. It employs a proxy template to allow a registered domain to impersonate targeted sites, such as Linkedin, Amazon, Okta, Github, Twitter, Instagram, Reddit, Office 365, and others. It can even register SSL certificates and camouflage them via a URL shortener, making them difficult to detect. Searches in this story look for signs of MiTM attacks enabled by EvilGinx2. @@ -433,7 +433,7 @@ narrative = The trojan downloader known as Emotet first surfaced in 2014, when i \ According to the TA, the the malware continues to be among the most costly and destructive malware affecting the private and public sectors. Researchers have linked it to the threat group Mealybug, which has also been on the security communitys radar since 2014.\ \ -The searches in this Analytic Story will help you find executables that are rarely used in your environment, specific registry paths that malware often uses to ensure survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that Emotet or other malware has compromised your environment. +The searches in this Analytic Story will help you find executables that are rarely used in your environment, specific registry paths that malware often uses to ensure survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that Emotet or other malware has compromised your environment. [Hidden Cobra Malware] category = Malware @@ -604,10 +604,10 @@ investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"] data_models = ["Authentication", "Endpoint", "Risk", "Updates", "Vulnerabilities", "Web"] providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Nessus", "Netbackup", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] -description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment. +description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment. narrative = It is critical to identify unauthorized software and processes running on enterprise endpoints and determine whether they are likely to be malicious. This Analytic Story requires the user to populate the Interesting Processes table within Enterprise Security with prohibited processes. An included support search will augment this data, adding information on processes thought to be malicious. This search requires data from endpoint detection-and-response solutions, endpoint data sources (such as Sysmon), or Windows Event Logs--assuming that the Active Directory administrator has enabled process tracking within the System Event Audit Logs.\ \ -It is important to investigate any software identified as suspicious, in order to understand how it was installed or executed. Analyzing authentication logs or any historic notable events might elicit additional investigative leads of interest. For best results, schedule the search to run every two weeks. +It is important to investigate any software identified as suspicious, in order to understand how it was installed or executed. Analyzing authentication logs or any historic notable events might elicit additional investigative leads of interest. For best results, schedule the search to run every two weeks. [Monitor for Updates] category = Best Practices @@ -966,7 +966,7 @@ investigative_searches = ["ESCU - AWS Investigate User Activities By ARN", "ESCU support_searches = ["ESCU - Previously seen users in CloudTrail"] data_models = [] providing_technologies = ["AWS", "Splunk Enterprise Security"] -description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. +description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker. [Suspicious AWS S3 Activities] @@ -987,7 +987,7 @@ narrative = As cloud computing has exploded, so has the number of creative attac \ Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\ \ -Among things to look out for are S3 access from unfamiliar locations and by unfamiliar users. Some of the searches in this Analytic Story help you detect suspicious behavior and others help you investigate more deeply, when the situation warrants. +Among things to look out for are S3 access from unfamiliar locations and by unfamiliar users. Some of the searches in this Analytic Story help you detect suspicious behavior and others help you investigate more deeply, when the situation warrants. [Suspicious AWS Traffic] category = Cloud Security @@ -1220,7 +1220,7 @@ investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - support_searches = [] data_models = ["Authentication", "Endpoint", "Risk"] providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] -description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others +description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms. [Windows File Extension and Association Abuse] diff --git a/src/default/savedsearches.conf b/src/default/savedsearches.conf index 557e354018..da24fe6618 100644 --- a/src/default/savedsearches.conf +++ b/src/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security-content -# On Date: 2019-05-15T20:03:38 UTC +# On Date: 2019-05-15T21:12:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -11,7 +11,7 @@ [ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." +description = This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." action.escu.mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]} action.escu.eli5 = The subsearch returns all events with event names that start with "Run" or "Create," and then does a `GeoIP` lookup on the IP address that initiated the action within the last hour. It appends the historical data to those results in the lookup file. Next, it recalculates the `firstTime` and `lastTime` field for each country, region, city, and IP address and outputs this data to the lookup file to update the local cache. It then calculates the `firstTime` and `lastTime` for each city. It returns only those events from cities that have first been seen in the past hour. This is combined with the main search to return the time, user, IP address, city, event name, and error code from the action. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. @@ -49,7 +49,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -65,7 +64,7 @@ search = sourcetype=aws:cloudtrail (eventName=Run* OR eventName=Create*) | iploc [ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." +description = This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." action.escu.mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]} action.escu.eli5 = The subsearch returns all events with event names that start with "Run" or "Create," and then does a `GeoIP` lookup on the IP address that initiated the action within the last hour. It appends the historical data to those results in the lookup file. Next, it recalculates the `firstTime` and `lastTime` field for each country, region, city, and IP address and outputs this data to the lookup file to update the local cache. It then calculates the `firstTime` and `lastTime` for each country. It returns only those events from countries that have first been seen in the past hour. This is combined with the main search to return the time, user, IP address, city, event name, and error code from the action. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. @@ -103,7 +102,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -119,7 +117,7 @@ search = sourcetype=aws:cloudtrail (eventName=Run* OR eventName=Create*) | iploc [ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." +description = This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." action.escu.mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]} action.escu.eli5 = The subsearch returns all events with event names that start with "Run" or "Create," and then does a `GeoIP` lookup on the IP address that initiated the action within the last hour. It appends the historical data to those results in the lookup file. Next, it recalculates the `firstTime` and `lastTime` field for each country, region, city, and IP address and outputs this data to the lookup file to update the local cache. It then calculates the `firstTime` and `lastTime` for each city. It returns only those events from IP addresses that have first been seen in the past hour. This is combined with the main search to return the time, user, IP address, city, event name, and error code from the action. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources. @@ -157,7 +155,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src_ip alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -211,7 +208,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -281,7 +277,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = requestingAccountId, requestedAccountId alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -333,7 +328,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src_user alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -385,7 +379,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src_user alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -437,7 +430,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = userName alert.suppress.period = 3600s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -489,7 +481,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = userName alert.suppress.period = 3600s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -542,7 +533,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = process, dest alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -595,7 +585,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = process_name, dest alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -648,7 +637,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, user alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -701,7 +689,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = process_name, dest alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -754,7 +741,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,file_name alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -807,7 +793,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, parent_process_name alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -860,7 +845,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -913,7 +897,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,file_name alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -966,7 +949,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,file_name alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -1019,7 +1001,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -1072,7 +1053,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,process_name alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -1125,7 +1105,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = query alert.suppress.period = 43200s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -1178,7 +1157,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = query alert.suppress.period = 43200s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -1231,7 +1209,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,src alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -1292,7 +1269,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -1345,7 +1321,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, user alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -1397,7 +1372,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = user alert.suppress.period = 84600s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -1449,7 +1423,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = user alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -1501,7 +1474,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -1562,7 +1534,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src, query alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -1623,7 +1594,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -1676,7 +1646,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = user alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -1729,7 +1698,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src_ip alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -1782,7 +1750,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -1834,7 +1801,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = user, dest, process alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -1886,7 +1852,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = user, dest, process alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -1938,7 +1903,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = user alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -1991,7 +1955,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,user alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -2043,7 +2006,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = user,bucketName alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -2096,7 +2058,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,file_name alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -2149,7 +2110,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src_ip alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -2176,7 +2136,7 @@ action.escu.modification_date = 2018-11-15 action.escu.confidence = medium action.escu.full_search_name = ESCU - Detect Path Interception By Creation Of program.exe - Rule action.escu.search_type = detection -action.escu.asset_at_risk = +action.escu.asset_at_risk = action.escu.fields_required = [] action.escu.providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Tanium", "Ziften"] action.escu.analytic_story = ["Windows Persistence Techniques"] @@ -2187,7 +2147,7 @@ action.correlationsearch.enabled = 1 action.correlationsearch.label = Detect Path Interception By Creation Of program.exe action.notable = 1 action.notable.param.nes_fields = dest, file_path, file_name -action.notable.param.rule_description = A potentially malicious file program.exe was detected on the C: drive. The creation of this file is often associated with a motive to perform a path interception attack. +action.notable.param.rule_description = A potentially malicious file program.exe was detected on the C: drive. The creation of this file is often associated with a motive to perform a path interception attack. action.notable.param.rule_title = Path Interception attempt discovered $dest$ via creation of program.exe action.notable.param.security_domain = endpoint action.notable.param.severity = medium @@ -2202,7 +2162,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, file_path, file_name alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -2255,7 +2214,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, parent_process alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -2308,7 +2266,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, process_name alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -2361,7 +2318,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, process alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -2379,7 +2335,7 @@ action.escu = 0 action.escu.enabled = 1 description = This search looks at S3 bucket-access logs and detects new or previously unseen remote IP addresses that have successfully accessed an S3 bucket. action.escu.mappings = {"mitre_attack": ["Execution", "Exfiltration"], "kill_chain_phases": ["Actions on Objectives"], "cis20": ["CIS 13", "CIS 14"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} -action.escu.eli5 = Here the subsearch executes first and returns all successful S3 bucket-access attempts (HTTP code "200") within the last hour. It groups the results by the earliest and latest times it has seen a remote IP accessing a particular bucket. It appends this information to the historical data from the lookup file and then recalculates the `firstTime` and `lastTime` field for each remote IP accessing an S3 bucket. Next, it returns only those remote IP addresses that have first been seen accessing a specific bucket within the past hour. This is combined with the main search to return the time, bucket name, source IP, city, and country operations performed, as well as the requested URI of the resource +action.escu.eli5 = Here the subsearch executes first and returns all successful S3 bucket-access attempts (HTTP code "200") within the last hour. It groups the results by the earliest and latest times it has seen a remote IP accessing a particular bucket. It appends this information to the historical data from the lookup file and then recalculates the `firstTime` and `lastTime` field for each remote IP accessing an S3 bucket. Next, it returns only those remote IP addresses that have first been seen accessing a specific bucket within the past hour. This is combined with the main search to return the time, bucket name, source IP, city, and country operations performed, as well as the requested URI of the resource action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access logs' inputs. This search works best when you run the "Previously Seen S3 Bucket Access by Remote IP" support search once to create a history of previously seen remote IPs and bucket names. action.escu.known_false_positives = S3 buckets can be accessed from any IP, as long as it can make a successful connection. This will be a false postive, since the search is looking for a new IP within the past hour action.escu.creation_date = 2018-06-25 @@ -2413,7 +2369,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = bucket_name, src_ip alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -2455,7 +2410,7 @@ action.escu.eli5 = This search and its corresponding subsearch run through a ser \ 1. Filters out anything that it determines is not a spike and returns the list of ARNs to the main search. The main search subsequently gets the names of all the API calls, the number of unique API calls, and the total number of API calls for each of these ARNs. Finally, it looks up the average and standard deviation and returns both the average and the number of standard deviations the spike is from the average. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. -action.escu.known_false_positives = +action.escu.known_false_positives = action.escu.creation_date = 2018-03-12 action.escu.modification_date = 2018-04-09 action.escu.confidence = medium @@ -2487,7 +2442,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = user alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -2561,7 +2515,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = user alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -2635,7 +2588,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = user alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -2709,7 +2661,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = user alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -2779,7 +2730,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src_ip alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -2832,7 +2782,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -2843,7 +2792,7 @@ quantity = 0 realtime_schedule = 0 schedule_window = auto is_visible = false -search = | tstats `summariesonly` count earliest(_time) AS earliest latest(_time) AS latest from datamodel=Change_Analysis where (nodename = All_Changes) All_Changes.result="Removable Storage device" (All_Changes.result_id=4663 OR All_Changes.result_id=4656) (All_Changes.src_priority=high) by All_Changes.dest | `drop_dm_object_name("All_Changes")`| `ctime(earliest)`| `ctime(latest)` +search = | tstats `summariesonly` count earliest(_time) AS earliest latest(_time) AS latest from datamodel=Change_Analysis where (nodename = All_Changes) All_Changes.result="Removable Storage device" (All_Changes.result_id=4663 OR All_Changes.result_id=4656) (All_Changes.src_priority=high) by All_Changes.dest | `drop_dm_object_name("All_Changes")`| `ctime(earliest)`| `ctime(latest)` [ESCU - Detect Unauthorized Assets by MAC address - Rule] action.escu = 0 @@ -2885,7 +2834,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src_mac,src_ip alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -2924,7 +2872,7 @@ action.correlationsearch.label = Detect Use of cmd.exe to Launch Script Interpre action.notable = 1 action.notable.param.nes_fields = dest, process_name, parent_process action.notable.param.rule_description = Potentially malicious script execution detected. -action.notable.param.rule_title = Command prompt is executing scripts on $dest$ using $process_name$ +action.notable.param.rule_title = Command prompt is executing scripts on $dest$ using $process_name$ action.notable.param.security_domain = endpoint action.notable.param.severity = medium action.notable.param.recommended_actions = escu_investigate @@ -2938,7 +2886,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, process_name alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -2975,7 +2922,7 @@ dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = Detect attackers scanning for vulnerable JBoss servers action.notable = 1 -action.notable.param.nes_fields = +action.notable.param.nes_fields = action.notable.param.rule_description = This search looks for specific GET/HEAD requests to web servers that are indicative of reconnaissance attempts to identify vulnerable JBoss servers. action.notable.param.rule_title = Detect attackers scanning for vulnerable JBoss servers action.notable.param.security_domain = network @@ -2991,7 +2938,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,url alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -3007,7 +2953,7 @@ search = | tstats `summariesonly` count min(_time) as firstTime max(_time) as la [ESCU - Detect hosts connecting to dynamic domain providers - Rule] action.escu = 0 action.escu.enabled = 1 -description = Malicious actors often abuse legitimate Dynamic DNS services to host malicious payloads or interactive command and control nodes. Attackers will automate domain resolution changes by routing dynamic domains to countless IP addresses to circumvent firewall blocks, blacklists as well as frustrate a network defenders analytic and investigative processes. This search will look for DNS queries made from within your infrastructure to suspicious dynamic domains. +description = Malicious actors often abuse legitimate Dynamic DNS services to host malicious payloads or interactive command and control nodes. Attackers will automate domain resolution changes by routing dynamic domains to countless IP addresses to circumvent firewall blocks, blacklists as well as frustrate a network defenders analytic and investigative processes. This search will look for DNS queries made from within your infrastructure to suspicious dynamic domains. action.escu.mappings = {"mitre_attack": ["Exfiltration", "Exfiltration Over Command and Control Channel", "Defense Evasion", "Commonly Used Port"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]} action.escu.data_models = ["Network_Resolution"] action.escu.eli5 = The search is querying an accelerated `Network_Resolution` data model to count and list the values of resolved domains for each DNS query and checks that against the list of Dynamic DNS providers (lookup - `dynamic_dns_providers`) by each host (DNS.src) @@ -3044,7 +2990,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src, query alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -3097,7 +3042,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,url,src alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -3150,7 +3094,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, process, parent_process_name alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -3202,7 +3145,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = user alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -3254,7 +3196,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = arn alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -3265,7 +3206,7 @@ quantity = 0 realtime_schedule = 0 schedule_window = auto is_visible = false -search = sourcetype=aws:cloudtrail eventName=ConsoleLogin | rename userIdentity.arn as arn |stats earliest(_time) as earliest latest(_time) as latest by arn | inputlookup append=t previously_seen_users_console_logins.csv | stats min(earliest) as earliest max(latest) as latest by arn | outputlookup previously_seen_users_console_logins.csv | eval userStatus=if(earliest >= relative_time(now(), "-70m@m"), "First Time Logging into AWS Console","Previously Seen User") | convert ctime(earliest) ctime(latest) | where userStatus ="First Time Logging into AWS Console" +search = sourcetype=aws:cloudtrail eventName=ConsoleLogin | rename userIdentity.arn as arn |stats earliest(_time) as earliest latest(_time) as latest by arn | inputlookup append=t previously_seen_users_console_logins.csv | stats min(earliest) as earliest max(latest) as latest by arn | outputlookup previously_seen_users_console_logins.csv | eval userStatus=if(earliest >= relative_time(now(), "-70m@m"), "First Time Logging into AWS Console","Previously Seen User") | convert ctime(earliest) ctime(latest) | where userStatus ="First Time Logging into AWS Console" [ESCU - Detect processes used for System Network Configuration Discovery - Rule] action.escu = 0 @@ -3307,7 +3248,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,user alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -3360,7 +3300,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src, url , dest alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -3413,7 +3352,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src, query alert.suppress.period = 43200s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -3466,7 +3404,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, process alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -3519,7 +3456,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, user, registry_path alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -3571,7 +3507,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = user, dest alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -3623,7 +3558,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = awsRegion alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -3675,7 +3609,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -3727,7 +3660,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -3779,7 +3711,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = user, dest alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -3832,7 +3763,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src_user alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -3870,7 +3800,7 @@ action.correlationsearch.enabled = 1 action.correlationsearch.label = Email files written outside of the Outlook directory action.notable = 1 action.notable.param.nes_fields = dest, file_path, action, file_name -action.notable.param.rule_description = The system $dest$ has email files outside of the normal Outlook directory +action.notable.param.rule_description = The system $dest$ has email files outside of the normal Outlook directory action.notable.param.rule_title = Email files created or modified on $dest$ that are not in the normal Outlook directory action.notable.param.security_domain = endpoint action.notable.param.severity = medium @@ -3885,7 +3815,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, file_path alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -3938,7 +3867,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest_ip alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -3991,7 +3919,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src,query alert.suppress.period = 43200s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -4044,7 +3971,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,process alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -4097,7 +4023,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, process alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -4149,7 +4074,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -4202,7 +4126,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,file_name alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -4254,7 +4177,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = serviceName, dest alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -4307,7 +4229,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, process, process alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -4328,13 +4249,13 @@ action.escu.mappings = {"mitre_attack": ["Defense Evasion", "Persistence"], "kil action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is looking to detect command-line execution with of attrib.exe binary with the +h flag set. The +h flag is used to hide a file. action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. -action.escu.known_false_positives = Some applications and users may legitimately use attrib.exe to interact with the files. +action.escu.known_false_positives = Some applications and users may legitimately use attrib.exe to interact with the files. action.escu.creation_date = 2017-10-23 action.escu.modification_date = 2018-11-15 action.escu.confidence = medium action.escu.full_search_name = ESCU - Hiding Files And Directories With Attrib.exe - Rule action.escu.search_type = detection -action.escu.asset_at_risk = +action.escu.asset_at_risk = action.escu.fields_required = [] action.escu.providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Persistence Techniques"] @@ -4346,7 +4267,7 @@ action.correlationsearch.label = Hiding Files And Directories With Attrib.exe action.notable = 1 action.notable.param.nes_fields = dest, user, process action.notable.param.rule_description = Attrib.exe is often used by attackers to hide malware files and directories in windows environments. This rule detects command-line arguments used to hide a file/directory -action.notable.param.rule_title = Suspicious usage of attrib.exe on $dest$ +action.notable.param.rule_title = Suspicious usage of attrib.exe on $dest$ action.notable.param.security_domain = endpoint action.notable.param.severity = medium action.notable.param.recommended_actions = escu_investigate @@ -4360,7 +4281,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, process alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -4413,7 +4333,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src_ip alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -4466,7 +4385,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = identity alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -4519,7 +4437,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest alert.suppress.period = 7200s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -4572,7 +4489,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = process_name, dest alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -4625,7 +4541,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, user, process_name alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -4678,7 +4593,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, process_name alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -4731,7 +4645,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, process_name alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -4784,7 +4697,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,process_name,process alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -4837,7 +4749,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src,query alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -4890,7 +4801,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = message_id, src_user alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -4943,7 +4853,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, registry_path alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -4996,7 +4905,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -5049,7 +4957,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -5102,7 +5009,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = host alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -5155,7 +5061,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = host alert.suppress.period = 3600s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -5208,7 +5113,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -5261,7 +5165,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, user alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -5314,7 +5217,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = host alert.suppress.period = 3600s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -5367,7 +5269,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, process alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -5405,7 +5306,7 @@ action.correlationsearch.enabled = 1 action.correlationsearch.label = Processes launching netsh action.notable = 1 action.notable.param.nes_fields = dest, process, parent_process, cmdline -action.notable.param.rule_description = A process detected on $dest$ is launching netsh.exe. +action.notable.param.rule_description = A process detected on $dest$ is launching netsh.exe. action.notable.param.rule_title = Process launching netsh.exe detected on $dest$ action.notable.param.security_domain = endpoint action.notable.param.severity = medium @@ -5420,7 +5321,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, parent_process alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -5473,7 +5373,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest_ip,src_ip alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -5526,7 +5425,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,user alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -5579,7 +5477,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest_ip, dest_port alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -5632,7 +5529,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -5685,7 +5581,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, process alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -5712,7 +5607,7 @@ action.escu.modification_date = 2019-02-27 action.escu.confidence = medium action.escu.full_search_name = ESCU - Reg.exe used to hide files/directories via registry keys - Rule action.escu.search_type = detection -action.escu.asset_at_risk = +action.escu.asset_at_risk = action.escu.fields_required = [] action.escu.providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Windows Defense Evasion Tactics", "Windows Persistence Techniques"] @@ -5724,7 +5619,7 @@ action.correlationsearch.label = Reg.exe used to hide files/directories via regi action.notable = 1 action.notable.param.nes_fields = dest, process action.notable.param.rule_description = Regedit.exe is used by attackers to hide malware files/directories in windows environments via registry key settings. This rule detects command-line arguments used to hide a file/directory -action.notable.param.rule_title = Regedit.exe used to hide a file/directory on $dest$ +action.notable.param.rule_title = Regedit.exe used to hide a file/directory on $dest$ action.notable.param.security_domain = endpoint action.notable.param.severity = medium action.notable.param.recommended_actions = escu_investigate @@ -5738,7 +5633,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,process alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -5791,7 +5685,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,user,registry_path alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -5844,7 +5737,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, user, registry_path alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -5897,7 +5789,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,object_path alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -5950,7 +5841,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,src alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -6003,7 +5893,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,src alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -6056,7 +5945,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,user alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -6109,7 +5997,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,user,process alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -6162,7 +6049,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, user,registry_path alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -6215,7 +6101,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,user,process_name alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -6268,7 +6153,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,user alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -6321,7 +6205,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -6374,7 +6257,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -6427,7 +6309,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,src,url alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -6480,7 +6361,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,file_name alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -6533,7 +6413,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, process alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -6586,7 +6465,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, process_name, process alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -6639,7 +6517,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, process_name alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -6692,7 +6569,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,process alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -6745,7 +6621,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, process alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -6798,7 +6673,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,process alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -6851,7 +6725,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -6904,7 +6777,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,user alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -6957,7 +6829,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = user alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -7010,7 +6881,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, user alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -7063,7 +6933,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -7116,7 +6985,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest alert.suppress.period = 7200s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -7168,7 +7036,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, src_ip alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -7221,7 +7088,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,user alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -7274,7 +7140,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src_user,message_id alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -7327,7 +7192,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,file_name alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -7379,7 +7243,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src, url, http_user_agent alert.suppress.period = 3600s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -7422,7 +7285,7 @@ action.notable.param.rule_title = LNK file $file_name$ is executing process $pro action.notable.param.security_domain = network action.notable.param.severity = high action.notable.param.recommended_actions = escu_investigate -action.notable.param.next_steps = +action.notable.param.next_steps = action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system @@ -7432,7 +7295,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,file_name alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -7485,7 +7347,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, user alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -7512,7 +7373,7 @@ action.escu.modification_date = 2019-02-28 action.escu.confidence = medium action.escu.full_search_name = ESCU - Suspicious wevtutil Usage - Rule action.escu.search_type = detection -action.escu.asset_at_risk = +action.escu.asset_at_risk = action.escu.fields_required = [] action.escu.providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] action.escu.analytic_story = ["Ransomware", "Windows Log Manipulation"] @@ -7538,7 +7399,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,process alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -7590,7 +7450,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -7643,7 +7502,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -7696,7 +7554,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,process_name alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -7749,7 +7606,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = src_ip alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -7802,7 +7658,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,user,process_name alert.suppress.period = 14400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -7855,7 +7710,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, user alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -7907,7 +7761,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -7934,7 +7787,7 @@ action.escu.modification_date = 2019-02-28 action.escu.confidence = medium action.escu.full_search_name = ESCU - Unusually Long Command Line - Rule action.escu.search_type = detection -action.escu.asset_at_risk = +action.escu.asset_at_risk = action.escu.fields_required = [] action.escu.providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] action.escu.analytic_story = ["Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Suspicious Command-Line Executions", "Unusual Processes"] @@ -7960,7 +7813,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,user,process alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -7987,7 +7839,7 @@ action.escu.modification_date = 2019-05-08 action.escu.confidence = medium action.escu.full_search_name = ESCU - Unusually Long Command Line - MLTK - Rule action.escu.search_type = detection -action.escu.asset_at_risk = +action.escu.asset_at_risk = action.escu.fields_required = [] action.escu.providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] action.escu.analytic_story = ["Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Suspicious Command-Line Executions", "Unusual Processes"] @@ -8013,7 +7865,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,user,process alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -8065,7 +7916,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest_ip alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -8117,7 +7967,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -8169,7 +8018,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,user alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -8221,7 +8069,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,user alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -8273,7 +8120,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = user alert.suppress.period = 3600s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -8325,7 +8171,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = session_id alert.suppress.period = 3600s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -8377,7 +8222,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = user alert.suppress.period = 3600s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -8430,7 +8274,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, process alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -8482,7 +8325,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest, signature_id alert.suppress.period = 28800s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -8535,7 +8377,6 @@ alert.digest_mode = 1 alert.suppress = 1 alert.suppress.fields = dest,user alert.suppress.period = 86400s -is_visible = false action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 disabled=true @@ -8571,7 +8412,7 @@ action.escu.fields_required = ["arn"] disabled=true schedule_window = auto is_visible = false -search = | search sourcetype=aws:cloudtrail userIdentity.arn={arn} | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType +search = | search sourcetype=aws:cloudtrail userIdentity.arn={arn} | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType [ESCU - AWS Investigate User Activities By AccessKeyId] action.escu = 0 @@ -8831,7 +8672,7 @@ action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative action.escu.full_search_name = ESCU - Get Certificate logs for a domain -description = This search queries the Certificates datamodel and give you all the information for a specific domain. Please note that if the certificate information +description = This search queries the Certificates datamodel and give you all the information for a specific domain. Please note that if the certificate information action.escu.creation_date = 2019-04-29 action.escu.modification_date = 2019-04-29 action.escu.analytic_story = ["Common Phishing Frameworks"] @@ -8873,7 +8714,7 @@ action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative action.escu.full_search_name = ESCU - Get DNS traffic ratio -description = This search calculates the ratio of DNS traffic originating and coming from a host to a list of DNS servers over the last 24 hours. A high value of this ratio could be very useful to quickly understand if a src_ip (host) is sending a high volume of data out via port 53, could be an indicator of data exfiltration via DNS. +description = This search calculates the ratio of DNS traffic originating and coming from a host to a list of DNS servers over the last 24 hours. A high value of this ratio could be very useful to quickly understand if a src_ip (host) is sending a high volume of data out via port 53, could be an indicator of data exfiltration via DNS. action.escu.creation_date = 2017-04-10 action.escu.modification_date = 2017-11-09 action.escu.analytic_story = ["Command and Control", "Data Protection", "Dynamic DNS", "Hidden Cobra Malware", "Suspicious DNS Traffic"] @@ -9168,7 +9009,7 @@ action.escu.fields_required = ["process_name", "dest"] disabled=true schedule_window = auto is_visible = false -search = | tstats `summariesonly` count min(_time) max(_time) as lastTime from datamodel=Endpoint.Processes where Proceses.dest={dest} Proceses.process_name={process_name} by Processes.parent_process Processes.process_name Processes.user Processes.dest | `drop_dm_object_name(Processes)` | `ctime(firstTime)`|`ctime(lastTime)` +search = | tstats `summariesonly` count min(_time) max(_time) as lastTime from datamodel=Endpoint.Processes where Proceses.dest={dest} Proceses.process_name={process_name} by Processes.parent_process Processes.process_name Processes.user Processes.dest | `drop_dm_object_name(Processes)` | `ctime(firstTime)`|`ctime(lastTime)` [ESCU - Get Process Information For Port Activity] action.escu = 0 @@ -9241,7 +9082,7 @@ action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative action.escu.full_search_name = ESCU - Get Risk Modifiers For Endpoint -description = For the last 7 days, the search will query the Risk data model in Splunk Enterprise Security and calculate the count, sum of the risk\_scores, names of the correlation searches that contributed to create a risk score for a specific endpoint(machine\_name) +description = For the last 7 days, the search will query the Risk data model in Splunk Enterprise Security and calculate the count, sum of the risk\_scores, names of the correlation searches that contributed to create a risk score for a specific endpoint(machine\_name) action.escu.creation_date = 2017-10-14 action.escu.modification_date = 2017-10-19 action.escu.analytic_story = ["Account Monitoring and Controls", "Apache Struts Vulnerability", "Asset Tracking", "Brand Monitoring", "ColdRoot MacOS RAT", "Collection and Staging", "Command and Control", "Credential Dumping", "DHS Report TA18-074A", "DNS Amplification Attacks", "Data Protection", "Disabling Security Tools", "Dynamic DNS", "Emotet Malware (TA18-201A)", "Hidden Cobra Malware", "Host Redirection", "JBoss Vulnerability", "Lateral Movement", "Malicious PowerShell", "Monitor Backup Solution", "Monitor for Unauthorized Software", "Monitor for Updates", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Router & Infrastructure Security", "SQL Injection", "SamSam Ransomware", "Spectre And Meltdown Vulnerabilities", "Splunk Enterprise Vulnerability", "Splunk Enterprise Vulnerability CVE-2018-11409", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious Emails", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Use of Cleartext Protocols", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse"] @@ -9263,7 +9104,7 @@ action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative action.escu.full_search_name = ESCU - Get Risk Modifiers For User -description = For the last 7 days, the search will query the Risk data model in Splunk Enterprise Security and calculate the count, sum of the risk_scores, names of the correlation searches that contributed to create a risk score for a specific user +description = For the last 7 days, the search will query the Risk data model in Splunk Enterprise Security and calculate the count, sum of the risk_scores, names of the correlation searches that contributed to create a risk score for a specific user action.escu.creation_date = 2017-10-14 action.escu.modification_date = 2017-10-19 action.escu.analytic_story = ["Account Monitoring and Controls", "Apache Struts Vulnerability", "Asset Tracking", "Brand Monitoring", "ColdRoot MacOS RAT", "Collection and Staging", "Command and Control", "Credential Dumping", "DHS Report TA18-074A", "DNS Amplification Attacks", "Data Protection", "Disabling Security Tools", "Dynamic DNS", "Emotet Malware (TA18-201A)", "Hidden Cobra Malware", "Host Redirection", "JBoss Vulnerability", "Lateral Movement", "Malicious PowerShell", "Monitor Backup Solution", "Monitor for Unauthorized Software", "Monitor for Updates", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Router & Infrastructure Security", "SQL Injection", "SamSam Ransomware", "Spectre And Meltdown Vulnerabilities", "Splunk Enterprise Vulnerability", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious Emails", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Use of Cleartext Protocols", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse"] @@ -9278,7 +9119,7 @@ action.escu.fields_required = ["user"] disabled=true schedule_window = auto is_visible = false -search = | from datamodel:Risk.All_Risk | search risk_object_type=user risk_object={user} | stats count sum(risk_score) as risk_score values(search_name) min(_time) as firstTime max(_time) as lastTime by risk_object |`ctime(firstTime)` |`ctime(lastTime)` +search = | from datamodel:Risk.All_Risk | search risk_object_type=user risk_object={user} | stats count sum(risk_score) as risk_score values(search_name) min(_time) as firstTime max(_time) as lastTime by risk_object |`ctime(firstTime)` |`ctime(lastTime)` [ESCU - Get Sysmon WMI Activity for Host] action.escu = 0 @@ -9406,7 +9247,7 @@ action.escu.fields_required = ["user"] disabled=true schedule_window = auto is_visible = false -search = | search sourcetype=aws:cloudtrail user={user} | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType +search = | search sourcetype=aws:cloudtrail user={user} | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType [ESCU - Investigate AWS activities via region name] action.escu = 0 @@ -9456,7 +9297,7 @@ action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative action.escu.full_search_name = ESCU - Investigate Successful Remote Desktop Authentications -description = This search returns the source, destination, and user for all successful remote-desktop authentications. A successful authentication after a brute-force attack on a destination machine is suspicious behavior. +description = This search returns the source, destination, and user for all successful remote-desktop authentications. A successful authentication after a brute-force attack on a destination machine is suspicious behavior. action.escu.creation_date = 2018-12-14 action.escu.modification_date = 2018-12-14 action.escu.analytic_story = ["DHS Report TA18-074A", "Emotet Malware (TA18-201A)", "Hidden Cobra Malware", "JBoss Vulnerability", "Lateral Movement", "Monitor for Unauthorized Software", "Ransomware", "SamSam Ransomware"] @@ -9543,7 +9384,7 @@ action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative action.escu.full_search_name = ESCU - Investigate Web POSTs From src -description = This investigative search retrieves POST requests from a specified source IP or hostname. Identifying the POST requests, as well as their associated destination URLs and user agent(s), may help you scope and characterize the suspicious traffic. +description = This investigative search retrieves POST requests from a specified source IP or hostname. Identifying the POST requests, as well as their associated destination URLs and user agent(s), may help you scope and characterize the suspicious traffic. action.escu.creation_date = 2018-12-06 action.escu.modification_date = 2018-12-06 action.escu.analytic_story = ["Apache Struts Vulnerability"] @@ -9579,7 +9420,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["Splunk Enterprise Security"] action.escu.eli5 = This search outputs the interesting processes lookup table and filters out all processes in the table that haven't already been inserted by ESCU. It then appends to those results all the processes currently identified by ESCU that should be prohibited. Next, it fills in the required fields with processes identified by ESCU, and then writes the results back to the interesting process lookup table. This is done so any new processes identified that should be prohibited will be added to the lookup table without creating any duplicate entries. action.escu.how_to_implement = This search should be run on each new install of ESCU. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -9599,7 +9440,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["AWS"] action.escu.eli5 = This search returns all log events that are API calls, pulls out the ARN that initiated each call, and collects them in one-hour groupings. Next, it calculates the number of API calls made per ARN per hour. For each ARN, it calculates the average and standard deviation of this count on a per-hour basis. It also includes the number of data points each ARN had. This table is then stored in a lookup file. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -9620,7 +9461,7 @@ dispatch.latest_time = -1d@d action.escu.providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] action.escu.eli5 = Create a machine-learning (ML) model to characterize the length of the command lines used in your environment. This can help you identify unusually long ones that may indicate that attackers are executing commands on yout systems. action.escu.how_to_implement = You must be ingesting endpoint data and populating the Endpoint data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -9641,7 +9482,7 @@ dispatch.latest_time = -1d@d action.escu.providing_technologies = ["Splunk Stream", "Bro"] action.escu.eli5 = Create a machine-learning (ML) model to characterize the length of DNS requests seen in your environment to help identify unusually long ones that may be indicative of attacker infrastrucutre or the use of DNS as a command-and-control channel in your environment. action.escu.how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -9661,7 +9502,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["AWS"] action.escu.eli5 = Use this search to create a baseline for API calls related to network ACLs for the users who initiated this activity. It returns all logged API calls for network activity, pulls out the ARN that initiated each call, and collects the `eventNames` in one-hour groupings. Next, it calculates the number of API calls made per ARN per-hour. For each ARN, it calculates the average and standard deviation of this count on a per-hour basis. It also includes the number of data points for each ARN. This table is stored in a lookup file. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for network ACLs, edit the macro `NetworkACLEvents`. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -9681,7 +9522,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["AWS"] action.escu.eli5 = Use this search to create a baseline for API calls related to deleting an S3 bucket, grouped by the users who initiated this activity. It returns all logged API calls for S3 bucket-deletion activity and then pulls out the ARN that initiated each call. Next, it calculates the number of API calls made per ARN per hour. For each ARN, it calculates the average and standard deviation of this count on a per-hour basis. It also includes the number of data points for each ARN. This table is stored in a lookup file. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -9702,7 +9543,7 @@ dispatch.latest_time = -1d@d action.escu.providing_technologies = ["Splunk Stream", "Bro"] action.escu.eli5 = Create a machine-learning (ML) model to characterize the number of SMB connections observed in your environment. This may help identify spikes in SMB traffic that may be indicative of attackers scanning or attempting to propagate to other systems in your environment. By default, this model is built over 30 days of data and profiles the number of SMB connections in your environment by the hour of day/day of week that the connections occur. action.escu.how_to_implement = You must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, you may consider adding "src" to the by clause, which will build the model for each unique source in your enviornment. However, if you have a large number of hosts in your environment, this search may be very resource intensive. In this case, you may need to raise the value of max_inputs and/or max_groups in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -9722,7 +9563,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["AWS"] action.escu.eli5 = Use this search to create a baseline for API calls related to security groups by the users who initiated this activity. It returns all logged API calls for all security-group-related activity, pulls out the ARN that initiated each call, and collects the `eventNames` in one-hour groupings. Next, it calculates the number of API calls made per ARN per hour. For each ARN, it calculates the average and standard deviation of this count on a per-hour basis. It also includes the number of data points for each ARN. This table is stored in a lookup file. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for security groups, edit the macro `securityGroupAPIs`. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -9742,7 +9583,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["AWS"] action.escu.eli5 = Use this search to create a baseline of blocked outbound network connections by each source IP in your AWS environment. This search returns all log events that correspond to a blocked outbound network connection, extracts the source IP from where the outbound connection was initiated, and collects the events in one-hour groupings. Next, it calculates the number of outbound connections blocked per hour. For each source IP, it calculates the average and standard deviation of this count on a per-hour basis. It also includes the number of data points each source IP had. This table is then stored in a lookup file. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow logs.`. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -9763,7 +9604,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["Splunk Stream", "Bro"] action.escu.eli5 = For each port being accessed on the network, this search gives the total number of connections observed, and the number of unique IP addresses making those connections. action.escu.how_to_implement = To successfully implement this search, you must be ingesting network traffic, and populating the Network_Traffic data model. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -9784,7 +9625,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["Splunk Enterprise Security"] action.escu.eli5 = This search gives you the number and the names of the hosts of each host in your environment by category. It will then sort them by the count. action.escu.how_to_implement = To successfully implement this search you must first leverage the Assets and Identity framework in Enterprise Security to populate your assets_by_str.csv file which should then be mapped to the Identity_Management data model. The Identity_Management data model will contain a list of known authorized company assets. Ensure that all inventoried systems are constantly vetted and updated. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -9804,7 +9645,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["AWS"] action.escu.eli5 = We first look for all successful CloudTrail API activity caused by types of user accounts and then remove all the events caused by users in the Identity table. This generates a list of accounts--typically service accounts--configured in your AWS environment. We output this list of service accounts to `aws_service_accounts.csv`. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the service account entires in `aws_service_accounts.csv`, which is a lookup file created as a result of running this support search. Please remove the entries of service accounts that are not legitimate. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -9824,7 +9665,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["Splunk Enterprise"] action.escu.eli5 = This search starts with the dnstwist command consuming domains from a file called domains.csv in the DA-ESS-SOC/lookups directory. This search then adds a domain\_abuse=true term to each permutation, removes all the valid domain names and stores all that information into a lookup file that is used in the associated detection search. Alternatively domain dnstwist permutations can be calculated from domains in the `cim_corporate_email_domains.csv` and `cim_corporate_web_domains.csv` lookups located in **Splunk\_SA\_CIM** using argument `populate_from_cim=true`. Also an individual domain can be passed using argument `domain=` action.escu.how_to_implement = To successfully implement this search you need to update the file called domains.csv in the DA-ESS-SOC/lookup directory. Or `cim_corporate_email_domains.csv` and `cim_corporate_web_domains.csv` from **Splunk\_SA\_CIM**. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -9845,7 +9686,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["Splunk Stream", "Bro"] action.escu.eli5 = Discover the DNS records and their answers for domains owned by the company using network traffic events. The discovered events are exported as a lookup named `discovered_dns_records.csv` action.escu.how_to_implement = To successfully implement this search, you must be ingesting DNS logs, and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation -action.escu.known_false_positives = Please vet the lookup created by this baseline search +action.escu.known_false_positives = Please vet the lookup created by this baseline search action.escu.fields_required = ["query", "answer"] disabled=true schedule_window = auto @@ -9867,7 +9708,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["Splunk Stream", "Bro"] action.escu.eli5 = This search counts the numbers of times the system has tried to connect to another system on TCP/3389, the default port used for RDP traffic. action.escu.how_to_implement = To successfully implement this search, you must ingest network traffic and populate the Network_Traffic data model. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -9888,7 +9729,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["Splunk Stream", "Bro"] action.escu.eli5 = This search counts the numbers of times the system has received a connection to TCP/ 3389, the default port used for RDP traffic. action.escu.how_to_implement = To successfully implement this search you must ingest network traffic and populate the Network_Traffic data model. If a system receives a lot of remote desktop traffic, you can apply the category common_rdp_destination to it. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -9909,7 +9750,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] action.escu.eli5 = This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. It does this by looking for the process name in the Endpoint data model. action.escu.how_to_implement = To successfully implement this search you must be ingesting endpoint data that records process activity. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -9929,7 +9770,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["Netbackup"] action.escu.eli5 = This search gives you the count and the hostname of all the systems that had a successful backup each day. action.escu.how_to_implement = To successfully implement this search you must be ingesting your backup logs. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -9949,7 +9790,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["Netbackup"] action.escu.eli5 = This search gives you the count and hostname of all the systems that had a backup failure each day action.escu.how_to_implement = To successfully implement this search you must be ingesting your backup logs. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -9969,7 +9810,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["AWS"] action.escu.eli5 = In this support search, we look for **AssumeRole** events where the requesting account is different from the requested account. The first and last times these events are seen are written to a lookup file. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -9989,7 +9830,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["AWS"] action.escu.eli5 = This search includes any event name that begins with "run" or "create," and then determines the first and last time these events were seen for each IP address that initiated the action. The search then consults a **GeoIP** database to determine the physical location of this IP address. This table outputs to a file. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -10009,7 +9850,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["AWS"] action.escu.eli5 = In this support search, we create a table of the first time (earliest) and most recent time (latest) that this region has been seen in our dataset, grouped by the value `awsRegion`. We only look for those events where an instance has been started. All of these entries will be added to the `previously_seen_aws_regions.csv` lookup file, which will act like a baseline for detections. Please validate the entries of region names in the lookup file. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -10029,7 +9870,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["AWS"] action.escu.eli5 = In this support search, we create a table of the earliest and latest time that a specific AMI ID has been seen. This table is then outputted to a csv file. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -10049,7 +9890,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["AWS"] action.escu.eli5 = In this support search, we create a table of the earliest and latest time that a specific EC2 instance type has been seen. The instanceType request field is not required and defaults to m1.small, so any time this field is null, the search defaults the field to m1.small. This table is then outputted to a csv file. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -10069,7 +9910,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["AWS"] action.escu.eli5 = In this support search, we create a table of the earliest and latest times that an ARN has launched a EC2 instance. This table is then outputted to a csv file. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -10089,7 +9930,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["AWS"] action.escu.eli5 = In this support search, we create a table of the earliest and latest times that an ARN has modified a EC2 instance. The list of APIs that modify an EC2 are defined in the `ec2ModificationAPIs` macro for ease of use. This table is then outputted to a file. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2ModificationAPIs`. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -10109,7 +9950,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["Microsoft Windows"] action.escu.eli5 = In this support search, we look for Windows system-event code that indicates a status change of a Windows service. It extracts both the name of the service and the action taken by the service from the logs. It keeps only services that have entered the running state. Finally, it finds the first time the service has been seen running across the enterprise and writes that file to a lookup table. action.escu.how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -10129,7 +9970,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["AWS"] action.escu.eli5 = In this support search, we are looking for successful API calls made by user roles within your AWS infrastructure. The intent is to create an initial baseline cache of names of the API calls per security role for the previous 30 days--including the earliest and latest times seen in our dataset--grouped by the value of user role and the name of the API call. It is also worth noting that the role of a particular user is parsed as "userName" in the CloudTrail logs. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user role entries in `previously_seen_api_calls_from_user_roles.csv`, which is a lookup file created as a result of running this support search. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -10149,7 +9990,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["AWS"] action.escu.eli5 = In this support search, we are looking for successful S3 bucket-access attempts made from remote IPs. The intent is to create an initial baseline cache of remote IP addresses per bucket name for the previous 30 days--including the earliest and latest times seen in our dataset--grouped by the value of remote IP and the name of the S3 bucket. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access-logs inputs. You must validate the remote IP and bucket name entries in `previously_seen_S3_access_from_remote_ip.csv`, which is a lookup file created as a result of running this support search. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -10170,7 +10011,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] action.escu.eli5 = In this support search, we look for command-line arguments using the parameter `/c` to execute processes and create an initial baseline cache for the previous 30 days. This will include the earliest and latest times a particular command-line argument is seen in our dataset, grouped by the command-line value. action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -10190,7 +10031,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["AWS"] action.escu.eli5 = In this support search, we look for console login events by a particular user and create an initial baseline cache for the previous seven days, including the earliest and latest times a particular user ARN is seen in our dataset, grouped by the ARN value. action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins.csv`, which is a lookup file created as a result of running this support search. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -10211,7 +10052,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] action.escu.eli5 = This search looks to see if a registry key was created at `HKLM\Software\Microsoft\Windows\CurrentVersion\QualityCompat`. It will tell you when it was created and, if possible, what process created it. action.escu.how_to_implement = You need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -10232,7 +10073,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["Microsoft Windows"] action.escu.eli5 = This search gives you the count of the number of systems that attempted and failed to install a Windows update each day. action.escu.how_to_implement = You must be ingesting your Windows Update Logs -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false @@ -10253,7 +10094,7 @@ dispatch.latest_time = -10m@m action.escu.providing_technologies = ["Microsoft Windows"] action.escu.eli5 = This search gives you the count and name of all the systems that had a successful update applied each day action.escu.how_to_implement = You must be ingesting your Windows Update Logs -action.escu.known_false_positives = +action.escu.known_false_positives = disabled=true schedule_window = auto is_visible = false diff --git a/src/default/use_case_library.conf b/src/default/use_case_library.conf index 754f110034..9387079d92 100644 --- a/src/default/use_case_library.conf +++ b/src/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security-content -# On Date: 2019-05-15T20:03:38 UTC +# On Date: 2019-05-15T21:12:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -177,7 +177,7 @@ references = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre. maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}] spec_version = 1 searches = ["ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"] -description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. +description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. narrative = A common adversary goal is to identify and exfiltrate data of value from a target organization. This data may include email conversations and addresses, confidential company information, links to network design/infrastructure, important dates, and so on.\ \ Attacks are composed of three activities: identification, collection, and staging data for exfiltration. Identification typically involves scanning systems and observing user activity. Collection can involve the transfer of large amounts of data from various repositories. Staging/preparation includes moving data to a central location and compressing (and optionally encoding and/or encrypting) it. All of these activities provide opportunities for defenders to identify their presence. \ @@ -205,7 +205,7 @@ references = ["https://github.com/kgretzky/evilginx2", "https://attack.mitre.org maintainers = [{"company": "Splunk", "email": "research@splunk.com", "name": "Splunk Research Team"}] spec_version = 2 searches = ["ESCU - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule", "ESCU - Get Certificate logs for a domain"] -description = Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email. +description = Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email. narrative = As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Because phishing is a technique that relies on human psychology, you will never be able to eliminate this vulnerability 100%. But you can use automated detection to significantly reduce the risks.\ \ This Analytic Story focuses on detecting signs of MiTM attacks enabled by [EvilGinx2](https://github.com/kgretzky/evilginx2), a toolkit that sets up a transparent proxy between the targeted site and the user. In this way, the attacker is able to intercept credentials and two-factor identification tokens. It employs a proxy template to allow a registered domain to impersonate targeted sites, such as Linkedin, Amazon, Okta, Github, Twitter, Instagram, Reddit, Office 365, and others. It can even register SSL certificates and camouflage them via a URL shortener, making them difficult to detect. Searches in this story look for signs of MiTM attacks enabled by EvilGinx2. @@ -328,7 +328,7 @@ narrative = The trojan downloader known as Emotet first surfaced in 2014, when i \ According to the TA, the the malware continues to be among the most costly and destructive malware affecting the private and public sectors. Researchers have linked it to the threat group Mealybug, which has also been on the security communitys radar since 2014.\ \ -The searches in this Analytic Story will help you find executables that are rarely used in your environment, specific registry paths that malware often uses to ensure survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that Emotet or other malware has compromised your environment. +The searches in this Analytic Story will help you find executables that are rarely used in your environment, specific registry paths that malware often uses to ensure survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that Emotet or other malware has compromised your environment. [analytic_story://Hidden Cobra Malware] category = Malware @@ -464,10 +464,10 @@ references = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}] spec_version = 1 searches = ["ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"] -description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment. +description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment. narrative = It is critical to identify unauthorized software and processes running on enterprise endpoints and determine whether they are likely to be malicious. This Analytic Story requires the user to populate the Interesting Processes table within Enterprise Security with prohibited processes. An included support search will augment this data, adding information on processes thought to be malicious. This search requires data from endpoint detection-and-response solutions, endpoint data sources (such as Sysmon), or Windows Event Logs--assuming that the Active Directory administrator has enabled process tracking within the System Event Audit Logs.\ \ -It is important to investigate any software identified as suspicious, in order to understand how it was installed or executed. Analyzing authentication logs or any historic notable events might elicit additional investigative leads of interest. For best results, schedule the search to run every two weeks. +It is important to investigate any software identified as suspicious, in order to understand how it was installed or executed. Analyzing authentication logs or any historic notable events might elicit additional investigative leads of interest. For best results, schedule the search to run every two weeks. [analytic_story://Monitor for Updates] category = Best Practices @@ -751,7 +751,7 @@ references = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integ maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}] spec_version = 1 searches = ["ESCU - Detect new user AWS Console Login - Rule", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Previously seen users in CloudTrail"] -description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. +description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker. [analytic_story://Suspicious AWS S3 Activities] @@ -767,7 +767,7 @@ narrative = As cloud computing has exploded, so has the number of creative attac \ Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\ \ -Among things to look out for are S3 access from unfamiliar locations and by unfamiliar users. Some of the searches in this Analytic Story help you detect suspicious behavior and others help you investigate more deeply, when the situation warrants. +Among things to look out for are S3 access from unfamiliar locations and by unfamiliar users. Some of the searches in this Analytic Story help you detect suspicious behavior and others help you investigate more deeply, when the situation warrants. [analytic_story://Suspicious AWS Traffic] category = Cloud Security @@ -940,7 +940,7 @@ references = ["https://attack.mitre.org/wiki/Defense_Evasion"] maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}] spec_version = 1 searches = ["ESCU - Suspicious Reg.exe Process - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Hiding Files And Directories With Attrib.exe - Rule", "ESCU - Reg.exe used to hide files/directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"] -description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others +description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms. [analytic_story://Windows File Extension and Association Abuse] @@ -1464,7 +1464,7 @@ providing_technologies = ["Bro", "Splunk Stream"] [savedsearch://ESCU - Detect Path Interception By Creation Of program.exe - Rule] type = detection -asset_type = +asset_type = confidence = medium explanation = This search queries the Endpoint file-system data model node to list out all the values of destination machines, as well as the values of file hashes and file paths that have the file "program.exe" in the C: drive. Path interception occurs when an executable is placed in a specific path so that it is executed by an application instead of by the intended target. In this case, applications vulnerable to path interception (because of unquoted service paths with spaces in Windows registry) allow attackers to execute maliciously crafted program.exes. how_to_implement = You must be ingesting data that records the file-system activity from your hosts to populate the Endpoint file-system data model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file system reads and writes. @@ -1506,7 +1506,7 @@ providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon type = detection asset_type = S3 Bucket confidence = low -explanation = Here the subsearch executes first and returns all successful S3 bucket-access attempts (HTTP code "200") within the last hour. It groups the results by the earliest and latest times it has seen a remote IP accessing a particular bucket. It appends this information to the historical data from the lookup file and then recalculates the `firstTime` and `lastTime` field for each remote IP accessing an S3 bucket. Next, it returns only those remote IP addresses that have first been seen accessing a specific bucket within the past hour. This is combined with the main search to return the time, bucket name, source IP, city, and country operations performed, as well as the requested URI of the resource +explanation = Here the subsearch executes first and returns all successful S3 bucket-access attempts (HTTP code "200") within the last hour. It groups the results by the earliest and latest times it has seen a remote IP accessing a particular bucket. It appends this information to the historical data from the lookup file and then recalculates the `firstTime` and `lastTime` field for each remote IP accessing an S3 bucket. Next, it returns only those remote IP addresses that have first been seen accessing a specific bucket within the past hour. This is combined with the main search to return the time, bucket name, source IP, city, and country operations performed, as well as the requested URI of the resource how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access logs' inputs. This search works best when you run the "Previously Seen S3 Bucket Access by Remote IP" support search once to create a history of previously seen remote IPs and bucket names. annotations = {"mitre_attack": ["Execution", "Exfiltration"], "kill_chain_phases": ["Actions on Objectives"], "cis20": ["CIS 13", "CIS 14"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} known_false_positives = S3 buckets can be accessed from any IP, as long as it can make a successful connection. This will be a false postive, since the search is looking for a new IP within the past hour @@ -1541,7 +1541,7 @@ explanation = This search and its corresponding subsearch run through a series o 1. Filters out anything that it determines is not a spike and returns the list of ARNs to the main search. The main search subsequently gets the names of all the API calls, the number of unique API calls, and the total number of API calls for each of these ARNs. Finally, it looks up the average and standard deviation and returns both the average and the number of standard deviations the spike is from the average. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. annotations = {"mitre_attack": ["Credential Access", "Execution"], "kill_chain_phases": ["Actions on Objectives"], "cis20": ["CIS 16"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} -known_false_positives = +known_false_positives = providing_technologies = ["AWS"] [savedsearch://ESCU - Detect Spike in Network ACL Activity - Rule] @@ -1960,12 +1960,12 @@ providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon [savedsearch://ESCU - Hiding Files And Directories With Attrib.exe - Rule] type = detection -asset_type = +asset_type = confidence = medium explanation = This search is looking to detect command-line execution with of attrib.exe binary with the +h flag set. The +h flag is used to hide a file. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. annotations = {"mitre_attack": ["Defense Evasion", "Persistence"], "kill_chain_phases": ["Actions on Objectives"], "cis20": ["CIS 8"], "nist": ["DE.CM"]} -known_false_positives = Some applications and users may legitimately use attrib.exe to interact with the files. +known_false_positives = Some applications and users may legitimately use attrib.exe to interact with the files. providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] [savedsearch://ESCU - Hosts receiving high volume of network traffic from email server - Rule] @@ -2220,7 +2220,7 @@ providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon [savedsearch://ESCU - Reg.exe used to hide files/directories via registry keys - Rule] type = detection -asset_type = +asset_type = confidence = medium explanation = Reg.exe is a binary native to Windows platform used to edit the registry hives of the system. Attackers can leverage this binary to hide files by passing in arguments that are used to hide the files. In the search, we first gather results with keywords, add, Hidden, and REG_DWORD, that will be in the raw event and filter by process and the command-line. We then leverage regular expressions on the command-line field to look for /d value as 2 which is responsible for hiding a file or directory. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. @@ -2560,7 +2560,7 @@ providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon [savedsearch://ESCU - Suspicious wevtutil Usage - Rule] type = detection -asset_type = +asset_type = confidence = medium explanation = This search looks for execution of wevtutil.exe with command-line arguments that indicate that it has been used to delete the setup, application, security, or system event logs. The search returns the number of times the behavior was observed, the first and last time it was seen, the host exhibiting the behavior and the user context of the process execution. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. @@ -2640,7 +2640,7 @@ providing_technologies = ["Netbackup"] [savedsearch://ESCU - Unusually Long Command Line - Rule] type = detection -asset_type = +asset_type = confidence = medium explanation = This search calculates the average and standard deviation for the length of the command lines on each of your endpoints and alerts when it detects a command line with a length over 10 times the standard deviation larger than the average command line. how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships, from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. @@ -2650,7 +2650,7 @@ providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon [savedsearch://ESCU - Unusually Long Command Line - MLTK - Rule] type = detection -asset_type = +asset_type = confidence = medium explanation = This search leverages the Machine Learning Toolkit (MLTK) to identify outliers in the length of the command lines observed to be used by a specific user. The companion search, "Baseline of Command Line Length - MLTK," creates a machine-learning (ML) model built over the historical data used by this search. how_to_implement = You must be ingesting endpoint data that monitors command lines and populates the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. In addition, MLTK version >= 4.2 must be installed on your search heads, along with any required dependencies. Finally, the support search "Baseline of Command Line Length - MLTK" must be executed before this detection search, as it builds an ML model over the historical data used by this search. @@ -3174,238 +3174,238 @@ latest_time_offset = 3600 type = support explanation = This search outputs the interesting processes lookup table and filters out all processes in the table that haven't already been inserted by ESCU. It then appends to those results all the processes currently identified by ESCU that should be prohibited. Next, it fills in the required fields with processes identified by ESCU, and then writes the results back to the interesting process lookup table. This is done so any new processes identified that should be prohibited will be added to the lookup table without creating any duplicate entries. how_to_implement = This search should be run on each new install of ESCU. -known_false_positives = +known_false_positives = providing_technologies = ["Splunk Enterprise Security"] [savedsearch://ESCU - Baseline of API Calls per User ARN] type = support explanation = This search returns all log events that are API calls, pulls out the ARN that initiated each call, and collects them in one-hour groupings. Next, it calculates the number of API calls made per ARN per hour. For each ARN, it calculates the average and standard deviation of this count on a per-hour basis. It also includes the number of data points each ARN had. This table is then stored in a lookup file. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -known_false_positives = +known_false_positives = providing_technologies = ["AWS"] [savedsearch://ESCU - Baseline of Command Line Length- MLTK] type = support explanation = Create a machine-learning (ML) model to characterize the length of the command lines used in your environment. This can help you identify unusually long ones that may indicate that attackers are executing commands on yout systems. how_to_implement = You must be ingesting endpoint data and populating the Endpoint data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. -known_false_positives = +known_false_positives = providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] [savedsearch://ESCU - Baseline of DNS Query Length - MLTK] type = support explanation = Create a machine-learning (ML) model to characterize the length of DNS requests seen in your environment to help identify unusually long ones that may be indicative of attacker infrastrucutre or the use of DNS as a command-and-control channel in your environment. how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. -known_false_positives = +known_false_positives = providing_technologies = ["Splunk Stream", "Bro"] [savedsearch://ESCU - Baseline of Network ACL Activity by ARN] type = support explanation = Use this search to create a baseline for API calls related to network ACLs for the users who initiated this activity. It returns all logged API calls for network activity, pulls out the ARN that initiated each call, and collects the `eventNames` in one-hour groupings. Next, it calculates the number of API calls made per ARN per-hour. For each ARN, it calculates the average and standard deviation of this count on a per-hour basis. It also includes the number of data points for each ARN. This table is stored in a lookup file. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for network ACLs, edit the macro `NetworkACLEvents`. -known_false_positives = +known_false_positives = providing_technologies = ["AWS"] [savedsearch://ESCU - Baseline of S3 Bucket deletion activity by ARN] type = support explanation = Use this search to create a baseline for API calls related to deleting an S3 bucket, grouped by the users who initiated this activity. It returns all logged API calls for S3 bucket-deletion activity and then pulls out the ARN that initiated each call. Next, it calculates the number of API calls made per ARN per hour. For each ARN, it calculates the average and standard deviation of this count on a per-hour basis. It also includes the number of data points for each ARN. This table is stored in a lookup file. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -known_false_positives = +known_false_positives = providing_technologies = ["AWS"] [savedsearch://ESCU - Baseline of SMB Traffic - MLTK] type = support explanation = Create a machine-learning (ML) model to characterize the number of SMB connections observed in your environment. This may help identify spikes in SMB traffic that may be indicative of attackers scanning or attempting to propagate to other systems in your environment. By default, this model is built over 30 days of data and profiles the number of SMB connections in your environment by the hour of day/day of week that the connections occur. how_to_implement = You must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, you may consider adding "src" to the by clause, which will build the model for each unique source in your enviornment. However, if you have a large number of hosts in your environment, this search may be very resource intensive. In this case, you may need to raise the value of max_inputs and/or max_groups in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. -known_false_positives = +known_false_positives = providing_technologies = ["Splunk Stream", "Bro"] [savedsearch://ESCU - Baseline of Security Group Activity by ARN] type = support explanation = Use this search to create a baseline for API calls related to security groups by the users who initiated this activity. It returns all logged API calls for all security-group-related activity, pulls out the ARN that initiated each call, and collects the `eventNames` in one-hour groupings. Next, it calculates the number of API calls made per ARN per hour. For each ARN, it calculates the average and standard deviation of this count on a per-hour basis. It also includes the number of data points for each ARN. This table is stored in a lookup file. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for security groups, edit the macro `securityGroupAPIs`. -known_false_positives = +known_false_positives = providing_technologies = ["AWS"] [savedsearch://ESCU - Baseline of blocked outbound traffic from AWS] type = support explanation = Use this search to create a baseline of blocked outbound network connections by each source IP in your AWS environment. This search returns all log events that correspond to a blocked outbound network connection, extracts the source IP from where the outbound connection was initiated, and collects the events in one-hour groupings. Next, it calculates the number of outbound connections blocked per hour. For each source IP, it calculates the average and standard deviation of this count on a per-hour basis. It also includes the number of data points each source IP had. This table is then stored in a lookup file. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow logs.`. -known_false_positives = +known_false_positives = providing_technologies = ["AWS"] [savedsearch://ESCU - Count of Unique IPs Connecting to Ports] type = support explanation = For each port being accessed on the network, this search gives the total number of connections observed, and the number of unique IP addresses making those connections. how_to_implement = To successfully implement this search, you must be ingesting network traffic, and populating the Network_Traffic data model. -known_false_positives = +known_false_positives = providing_technologies = ["Splunk Stream", "Bro"] [savedsearch://ESCU - Count of assets by category] type = support explanation = This search gives you the number and the names of the hosts of each host in your environment by category. It will then sort them by the count. how_to_implement = To successfully implement this search you must first leverage the Assets and Identity framework in Enterprise Security to populate your assets_by_str.csv file which should then be mapped to the Identity_Management data model. The Identity_Management data model will contain a list of known authorized company assets. Ensure that all inventoried systems are constantly vetted and updated. -known_false_positives = +known_false_positives = providing_technologies = ["Splunk Enterprise Security"] [savedsearch://ESCU - Create a list of approved AWS service accounts] type = support explanation = We first look for all successful CloudTrail API activity caused by types of user accounts and then remove all the events caused by users in the Identity table. This generates a list of accounts--typically service accounts--configured in your AWS environment. We output this list of service accounts to `aws_service_accounts.csv`. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the service account entires in `aws_service_accounts.csv`, which is a lookup file created as a result of running this support search. Please remove the entries of service accounts that are not legitimate. -known_false_positives = +known_false_positives = providing_technologies = ["AWS"] [savedsearch://ESCU - DNSTwist Domain Names] type = support explanation = This search starts with the dnstwist command consuming domains from a file called domains.csv in the DA-ESS-SOC/lookups directory. This search then adds a domain\_abuse=true term to each permutation, removes all the valid domain names and stores all that information into a lookup file that is used in the associated detection search. Alternatively domain dnstwist permutations can be calculated from domains in the `cim_corporate_email_domains.csv` and `cim_corporate_web_domains.csv` lookups located in **Splunk\_SA\_CIM** using argument `populate_from_cim=true`. Also an individual domain can be passed using argument `domain=` how_to_implement = To successfully implement this search you need to update the file called domains.csv in the DA-ESS-SOC/lookup directory. Or `cim_corporate_email_domains.csv` and `cim_corporate_web_domains.csv` from **Splunk\_SA\_CIM**. -known_false_positives = +known_false_positives = providing_technologies = ["Splunk Enterprise"] [savedsearch://ESCU - Discover DNS records] type = support explanation = Discover the DNS records and their answers for domains owned by the company using network traffic events. The discovered events are exported as a lookup named `discovered_dns_records.csv` how_to_implement = To successfully implement this search, you must be ingesting DNS logs, and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation -known_false_positives = Please vet the lookup created by this baseline search +known_false_positives = Please vet the lookup created by this baseline search providing_technologies = ["Splunk Stream", "Bro"] [savedsearch://ESCU - Identify Systems Creating Remote Desktop Traffic] type = support explanation = This search counts the numbers of times the system has tried to connect to another system on TCP/3389, the default port used for RDP traffic. how_to_implement = To successfully implement this search, you must ingest network traffic and populate the Network_Traffic data model. -known_false_positives = +known_false_positives = providing_technologies = ["Splunk Stream", "Bro"] [savedsearch://ESCU - Identify Systems Receiving Remote Desktop Traffic] type = support explanation = This search counts the numbers of times the system has received a connection to TCP/ 3389, the default port used for RDP traffic. how_to_implement = To successfully implement this search you must ingest network traffic and populate the Network_Traffic data model. If a system receives a lot of remote desktop traffic, you can apply the category common_rdp_destination to it. -known_false_positives = +known_false_positives = providing_technologies = ["Splunk Stream", "Bro"] [savedsearch://ESCU - Identify Systems Using Remote Desktop] type = support explanation = This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. It does this by looking for the process name in the Endpoint data model. how_to_implement = To successfully implement this search you must be ingesting endpoint data that records process activity. -known_false_positives = +known_false_positives = providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] [savedsearch://ESCU - Monitor Successful Backups] type = support explanation = This search gives you the count and the hostname of all the systems that had a successful backup each day. how_to_implement = To successfully implement this search you must be ingesting your backup logs. -known_false_positives = +known_false_positives = providing_technologies = ["Netbackup"] [savedsearch://ESCU - Monitor Unsuccessful Backups] type = support explanation = This search gives you the count and hostname of all the systems that had a backup failure each day how_to_implement = To successfully implement this search you must be ingesting your backup logs. -known_false_positives = +known_false_positives = providing_technologies = ["Netbackup"] [savedsearch://ESCU - Previously Seen AWS Cross Account Activity] type = support explanation = In this support search, we look for **AssumeRole** events where the requesting account is different from the requested account. The first and last times these events are seen are written to a lookup file. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. -known_false_positives = +known_false_positives = providing_technologies = ["AWS"] [savedsearch://ESCU - Previously Seen AWS Provisioning Activity Sources] type = support explanation = This search includes any event name that begins with "run" or "create," and then determines the first and last time these events were seen for each IP address that initiated the action. The search then consults a **GeoIP** database to determine the physical location of this IP address. This table outputs to a file. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. -known_false_positives = +known_false_positives = providing_technologies = ["AWS"] [savedsearch://ESCU - Previously Seen AWS Regions] type = support explanation = In this support search, we create a table of the first time (earliest) and most recent time (latest) that this region has been seen in our dataset, grouped by the value `awsRegion`. We only look for those events where an instance has been started. All of these entries will be added to the `previously_seen_aws_regions.csv` lookup file, which will act like a baseline for detections. Please validate the entries of region names in the lookup file. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -known_false_positives = +known_false_positives = providing_technologies = ["AWS"] [savedsearch://ESCU - Previously Seen EC2 AMIs] type = support explanation = In this support search, we create a table of the earliest and latest time that a specific AMI ID has been seen. This table is then outputted to a csv file. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -known_false_positives = +known_false_positives = providing_technologies = ["AWS"] [savedsearch://ESCU - Previously Seen EC2 Instance Types] type = support explanation = In this support search, we create a table of the earliest and latest time that a specific EC2 instance type has been seen. The instanceType request field is not required and defaults to m1.small, so any time this field is null, the search defaults the field to m1.small. This table is then outputted to a csv file. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -known_false_positives = +known_false_positives = providing_technologies = ["AWS"] [savedsearch://ESCU - Previously Seen EC2 Launches By User] type = support explanation = In this support search, we create a table of the earliest and latest times that an ARN has launched a EC2 instance. This table is then outputted to a csv file. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -known_false_positives = +known_false_positives = providing_technologies = ["AWS"] [savedsearch://ESCU - Previously Seen EC2 Modifications By User] type = support explanation = In this support search, we create a table of the earliest and latest times that an ARN has modified a EC2 instance. The list of APIs that modify an EC2 are defined in the `ec2ModificationAPIs` macro for ease of use. This table is then outputted to a file. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2ModificationAPIs`. -known_false_positives = +known_false_positives = providing_technologies = ["AWS"] [savedsearch://ESCU - Previously Seen Running Windows Services] type = support explanation = In this support search, we look for Windows system-event code that indicates a status change of a Windows service. It extracts both the name of the service and the action taken by the service from the logs. It keeps only services that have entered the running state. Finally, it finds the first time the service has been seen running across the enterprise and writes that file to a lookup table. how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. -known_false_positives = +known_false_positives = providing_technologies = ["Microsoft Windows"] [savedsearch://ESCU - Previously seen API call per user roles in CloudTrail] type = support explanation = In this support search, we are looking for successful API calls made by user roles within your AWS infrastructure. The intent is to create an initial baseline cache of names of the API calls per security role for the previous 30 days--including the earliest and latest times seen in our dataset--grouped by the value of user role and the name of the API call. It is also worth noting that the role of a particular user is parsed as "userName" in the CloudTrail logs. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user role entries in `previously_seen_api_calls_from_user_roles.csv`, which is a lookup file created as a result of running this support search. -known_false_positives = +known_false_positives = providing_technologies = ["AWS"] [savedsearch://ESCU - Previously seen S3 bucket access by remote IP] type = support explanation = In this support search, we are looking for successful S3 bucket-access attempts made from remote IPs. The intent is to create an initial baseline cache of remote IP addresses per bucket name for the previous 30 days--including the earliest and latest times seen in our dataset--grouped by the value of remote IP and the name of the S3 bucket. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access-logs inputs. You must validate the remote IP and bucket name entries in `previously_seen_S3_access_from_remote_ip.csv`, which is a lookup file created as a result of running this support search. -known_false_positives = +known_false_positives = providing_technologies = ["AWS"] [savedsearch://ESCU - Previously seen command line arguments] type = support explanation = In this support search, we look for command-line arguments using the parameter `/c` to execute processes and create an initial baseline cache for the previous 30 days. This will include the earliest and latest times a particular command-line argument is seen in our dataset, grouped by the command-line value. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. -known_false_positives = +known_false_positives = providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] [savedsearch://ESCU - Previously seen users in CloudTrail] type = support explanation = In this support search, we look for console login events by a particular user and create an initial baseline cache for the previous seven days, including the earliest and latest times a particular user ARN is seen in our dataset, grouped by the ARN value. how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins.csv`, which is a lookup file created as a result of running this support search. -known_false_positives = +known_false_positives = providing_technologies = ["AWS"] [savedsearch://ESCU - Systems Ready for Spectre-Meltdown Windows Patch] type = support explanation = This search looks to see if a registry key was created at `HKLM\Software\Microsoft\Windows\CurrentVersion\QualityCompat`. It will tell you when it was created and, if possible, what process created it. how_to_implement = You need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives = +known_false_positives = providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] [savedsearch://ESCU - Windows Updates Install Failures] type = support explanation = This search gives you the count of the number of systems that attempted and failed to install a Windows update each day. how_to_implement = You must be ingesting your Windows Update Logs -known_false_positives = +known_false_positives = providing_technologies = ["Microsoft Windows"] [savedsearch://ESCU - Windows Updates Install Successes] type = support explanation = This search gives you the count and name of all the systems that had a successful update applied each day how_to_implement = You must be ingesting your Windows Update Logs -known_false_positives = +known_false_positives = providing_technologies = ["Microsoft Windows"] ### END BASELINES ### \ No newline at end of file