From 8298acf18e08e920c84f4538c57afeefde9dc809 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Thu, 31 Mar 2022 15:29:51 -0700 Subject: [PATCH 1/3] powershelldetectionstaghermetic --- .../deprecated/suspicious_powershell_command_line_arguments.yml | 1 + detections/endpoint/any_powershell_downloadfile.yml | 1 + detections/endpoint/any_powershell_downloadstring.yml | 1 + .../detect_empire_with_powershell_script_block_logging.yml | 1 + .../detect_mimikatz_with_powershell_script_block_logging.yml | 1 + detections/endpoint/linux_java_spawning_shell.yml | 1 + .../endpoint/malicious_powershell_process___encoded_command.yml | 1 + .../malicious_powershell_process_with_obfuscation_techniques.yml | 1 + .../endpoint/possible_lateral_movement_powershell_spawn.yml | 1 + detections/endpoint/powershell_4104_hunting.yml | 1 + .../powershell___connect_to_internet_with_hidden_window.yml | 1 + detections/endpoint/powershell_domain_enumeration.yml | 1 + detections/endpoint/powershell_enable_smb1protocol_feature.yml | 1 + detections/endpoint/powershell_execute_com_object.yml | 1 + .../powershell_fileless_process_injection_via_getprocaddress.yml | 1 + ...owershell_fileless_script_contains_base64_encoded_content.yml | 1 + .../powershell_loading_dotnet_into_memory_via_reflection.yml | 1 + detections/endpoint/powershell_processing_stream_of_data.yml | 1 + detections/endpoint/powershell_using_memory_as_backing_store.yml | 1 + detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml | 1 + detections/endpoint/recon_using_wmi_class.yml | 1 + ...ult_powershell_execution_policy_to_unrestricted_or_bypass.yml | 1 + detections/endpoint/unloading_amsi_via_reflection.yml | 1 + detections/endpoint/w3wp_spawning_shell.yml | 1 + detections/endpoint/wmi_recon_running_process_or_services.yml | 1 + .../application/email_attachments_with_lots_of_spaces.yml | 1 + .../application/suspicious_email_attachment_extensions.yml | 1 + 27 files changed, 27 insertions(+) diff --git a/detections/deprecated/suspicious_powershell_command_line_arguments.yml b/detections/deprecated/suspicious_powershell_command_line_arguments.yml index ba0b5844f8..3cbf66655d 100644 --- a/detections/deprecated/suspicious_powershell_command_line_arguments.yml +++ b/detections/deprecated/suspicious_powershell_command_line_arguments.yml @@ -30,6 +30,7 @@ references: [] tags: analytic_story: - Malicious PowerShell + - Hermetic Wiper asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index f1fcd1ff8c..cf07696d64 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -31,6 +31,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md tags: analytic_story: + - Hermetic Wiper - Malicious PowerShell - Ingress Tool Transfer - Log4Shell CVE-2021-44228 diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml index 5a6661ba47..4638611219 100644 --- a/detections/endpoint/any_powershell_downloadstring.yml +++ b/detections/endpoint/any_powershell_downloadstring.yml @@ -30,6 +30,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md tags: analytic_story: + - Hermetic Wiper - Malicious PowerShell - HAFNIUM Group - Ingress Tool Transfer diff --git a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml index 43cb69453b..220e524b2a 100644 --- a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml @@ -37,6 +37,7 @@ references: - https://github.com/BC-SECURITY/Empire tags: analytic_story: + - Hermetic Wiper - Malicious PowerShell confidence: 90 context: diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml index 91725db158..7c4881395f 100644 --- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml @@ -34,6 +34,7 @@ references: - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ tags: analytic_story: + - Hermetic Wiper - Malicious PowerShell confidence: 100 context: diff --git a/detections/endpoint/linux_java_spawning_shell.yml b/detections/endpoint/linux_java_spawning_shell.yml index 2e91f5290d..8b846d0945 100644 --- a/detections/endpoint/linux_java_spawning_shell.yml +++ b/detections/endpoint/linux_java_spawning_shell.yml @@ -30,6 +30,7 @@ references: - https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72 tags: analytic_story: + - Hermetic Wiper - Log4Shell CVE-2021-44228 asset_type: Endpoint confidence: 50 diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index af0fe2a81a..4352f949f6 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -40,6 +40,7 @@ references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: + - Hermetic Wiper - Malicious PowerShell - NOBELIUM Group - WhisperGate diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml index 12c606d91f..f2aab5c416 100644 --- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml +++ b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml @@ -26,6 +26,7 @@ known_false_positives: These characters might be legitimately on the command-lin references: [] tags: analytic_story: + - Hermetic Wiper - Malicious PowerShell asset_type: Endpoint cis20: diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml index 542ded70c2..0f02d539bc 100644 --- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml +++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml @@ -37,6 +37,7 @@ references: - https://attack.mitre.org/techniques/T1543/003/ tags: analytic_story: + - Hermetic Wiper - Active Directory Lateral Movement - Malicious PowerShell confidence: 50 diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 21a467325e..65732d0319 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -49,6 +49,7 @@ references: - https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/ tags: analytic_story: + - Hermetic Wiper - Malicious PowerShell confidence: 100 context: diff --git a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml index 80f8bd4fcf..dfa2a7cc75 100644 --- a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml @@ -36,6 +36,7 @@ references: - https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/ tags: analytic_story: + - Hermetic Wiper - Malicious PowerShell - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - HAFNIUM Group diff --git a/detections/endpoint/powershell_domain_enumeration.yml b/detections/endpoint/powershell_domain_enumeration.yml index 92d160863e..b2a9e89b0c 100644 --- a/detections/endpoint/powershell_domain_enumeration.yml +++ b/detections/endpoint/powershell_domain_enumeration.yml @@ -32,6 +32,7 @@ references: - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ tags: analytic_story: + - Hermetic Wiper - Malicious PowerShell confidence: 70 context: diff --git a/detections/endpoint/powershell_enable_smb1protocol_feature.yml b/detections/endpoint/powershell_enable_smb1protocol_feature.yml index 1df1ea5de7..69f40f1f5b 100644 --- a/detections/endpoint/powershell_enable_smb1protocol_feature.yml +++ b/detections/endpoint/powershell_enable_smb1protocol_feature.yml @@ -22,6 +22,7 @@ references: - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ tags: analytic_story: + - Hermetic Wiper - Malicious PowerShell - Ransomware context: diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml index 09503bf1d2..2a553180e8 100644 --- a/detections/endpoint/powershell_execute_com_object.yml +++ b/detections/endpoint/powershell_execute_com_object.yml @@ -24,6 +24,7 @@ references: - https://threadreaderapp.com/thread/1423361119926816776.html tags: analytic_story: + - Hermetic Wiper - Malicious PowerShell - Ransomware confidence: 50 diff --git a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml index 58720e0384..8d9d719e90 100644 --- a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml +++ b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml @@ -35,6 +35,7 @@ references: - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ tags: analytic_story: + - Hermetic Wiper - Malicious PowerShell confidence: 80 context: diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index 81bdaae05e..9db6cc1d80 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -34,6 +34,7 @@ references: - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ tags: analytic_story: + - Hermetic Wiper - Malicious PowerShell confidence: 80 context: diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index 40060f2165..dd6af6110a 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -36,6 +36,7 @@ references: - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ tags: analytic_story: + - Hermetic Wiper - Malicious PowerShell confidence: 80 context: diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index e76eb82127..ad5bee4f5f 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -27,6 +27,7 @@ references: - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ tags: analytic_story: + - Hermetic Wiper - Malicious PowerShell confidence: 80 context: diff --git a/detections/endpoint/powershell_using_memory_as_backing_store.yml b/detections/endpoint/powershell_using_memory_as_backing_store.yml index 9c00507116..16e253edc3 100644 --- a/detections/endpoint/powershell_using_memory_as_backing_store.yml +++ b/detections/endpoint/powershell_using_memory_as_backing_store.yml @@ -27,6 +27,7 @@ references: - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ tags: analytic_story: + - Hermetic Wiper - Malicious PowerShell confidence: 80 context: diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index 3400ba0c25..e1f03ad8ad 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -28,6 +28,7 @@ references: - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ tags: analytic_story: + - Hermetic Wiper - Ransomware - Malicious PowerShell confidence: 80 diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml index e5cf058a7f..2cccbb268a 100644 --- a/detections/endpoint/recon_using_wmi_class.yml +++ b/detections/endpoint/recon_using_wmi_class.yml @@ -29,6 +29,7 @@ references: - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ tags: analytic_story: + - Hermetic Wiper - Malicious PowerShell confidence: 80 context: diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index e0151424a3..2d536fdcbd 100644 --- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -25,6 +25,7 @@ known_false_positives: Administrators may attempt to change the default executio references: [] tags: analytic_story: + - Hermetic Wiper - Malicious PowerShell - Credential Dumping - HAFNIUM Group diff --git a/detections/endpoint/unloading_amsi_via_reflection.yml b/detections/endpoint/unloading_amsi_via_reflection.yml index fe3ab95497..b915dd6625 100644 --- a/detections/endpoint/unloading_amsi_via_reflection.yml +++ b/detections/endpoint/unloading_amsi_via_reflection.yml @@ -35,6 +35,7 @@ references: - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ tags: analytic_story: + - Hermetic Wiper - Malicious PowerShell confidence: 70 context: diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml index a51b123789..488789d381 100644 --- a/detections/endpoint/w3wp_spawning_shell.yml +++ b/detections/endpoint/w3wp_spawning_shell.yml @@ -35,6 +35,7 @@ references: - https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do tags: analytic_story: + - Hermetic Wiper - HAFNIUM Group - ProxyShell confidence: 80 diff --git a/detections/endpoint/wmi_recon_running_process_or_services.yml b/detections/endpoint/wmi_recon_running_process_or_services.yml index be45120e36..bd73f3bf21 100644 --- a/detections/endpoint/wmi_recon_running_process_or_services.yml +++ b/detections/endpoint/wmi_recon_running_process_or_services.yml @@ -26,6 +26,7 @@ references: - https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/ tags: analytic_story: + - Hermetic Wiper - Malicious PowerShell confidence: 100 context: diff --git a/detections/experimental/application/email_attachments_with_lots_of_spaces.yml b/detections/experimental/application/email_attachments_with_lots_of_spaces.yml index 77658f2977..91c467bb77 100644 --- a/detections/experimental/application/email_attachments_with_lots_of_spaces.yml +++ b/detections/experimental/application/email_attachments_with_lots_of_spaces.yml @@ -32,6 +32,7 @@ known_false_positives: None at this time references: [] tags: analytic_story: + - Hermetic Wiper - 'Emotet Malware DHS Report TA18-201A ' - Suspicious Emails asset_type: Endpoint diff --git a/detections/experimental/application/suspicious_email_attachment_extensions.yml b/detections/experimental/application/suspicious_email_attachment_extensions.yml index 81732385d7..2cbd743631 100644 --- a/detections/experimental/application/suspicious_email_attachment_extensions.yml +++ b/detections/experimental/application/suspicious_email_attachment_extensions.yml @@ -29,6 +29,7 @@ known_false_positives: None identified references: [] tags: analytic_story: + - Hermetic Wiper - 'Emotet Malware DHS Report TA18-201A ' - Suspicious Emails asset_type: Endpoint From b3cd632c2961ccd67bec65b210d25613f7c1fd38 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 5 Apr 2022 07:55:03 -0700 Subject: [PATCH 2/3] hermeticwipertagswindowsprivesc --- detections/deprecated/uncommon_processes_on_endpoint.yml | 1 + detections/endpoint/active_setup_registry_autostart.yml | 1 + detections/endpoint/change_default_file_association.yml | 1 + detections/endpoint/etw_registry_disabled.yml | 1 + .../endpoint/kerberoasting_spn_request_with_rc4_encryption.yml | 1 + detections/endpoint/logon_script_event_trigger_execution.yml | 1 + 6 files changed, 6 insertions(+) diff --git a/detections/deprecated/uncommon_processes_on_endpoint.yml b/detections/deprecated/uncommon_processes_on_endpoint.yml index 19b471ac43..c3d7271351 100644 --- a/detections/deprecated/uncommon_processes_on_endpoint.yml +++ b/detections/deprecated/uncommon_processes_on_endpoint.yml @@ -26,6 +26,7 @@ tags: analytic_story: - Windows Privilege Escalation - Unusual Processes + - Hermetic Wiper asset_type: Endpoint cis20: - CIS 2 diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index 1e96c48710..aba210b24e 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -40,6 +40,7 @@ tags: analytic_story: - Windows Persistence Techniques - Windows Privilege Escalation + - Hermetic Wiper confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/change_default_file_association.yml b/detections/endpoint/change_default_file_association.yml index 9ccf8f7656..34c1cdecce 100644 --- a/detections/endpoint/change_default_file_association.yml +++ b/detections/endpoint/change_default_file_association.yml @@ -31,6 +31,7 @@ tags: - Windows Persistence Techniques - Windows Privilege Escalation - Windows Registry Abuse + - Hermetic Wiper confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index 960f779de5..56af0e84d8 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -38,6 +38,7 @@ tags: - Windows Persistence Techniques - Windows Privilege Escalation - Windows Registry Abuse + - Hermetic Wiper confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml index d8be269db0..e066626974 100644 --- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml +++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml @@ -30,6 +30,7 @@ tags: analytic_story: - Windows Privilege Escalation - Active Directory Kerberos Attacks + - Hermetic Wiper asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/logon_script_event_trigger_execution.yml b/detections/endpoint/logon_script_event_trigger_execution.yml index fb85e8052e..46e8bea28d 100644 --- a/detections/endpoint/logon_script_event_trigger_execution.yml +++ b/detections/endpoint/logon_script_event_trigger_execution.yml @@ -28,6 +28,7 @@ tags: analytic_story: - Windows Persistence Techniques - Windows Privilege Escalation + - Hermetic Wiper confidence: 100 context: - Source:Endpoint From 901a73aa5ff79acfae83fffb6c60f0f8ebff5f2d Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 5 Apr 2022 08:02:47 -0700 Subject: [PATCH 3/3] secondbatchwinprivesctaghermeticwiper --- detections/endpoint/msi_module_loaded_by_non_system_binary.yml | 1 + detections/endpoint/overwriting_accessibility_binaries.yml | 1 + .../endpoint/registry_keys_used_for_privilege_escalation.yml | 1 + detections/endpoint/runas_execution_in_commandline.yml | 1 + detections/endpoint/screensaver_event_trigger_execution.yml | 1 + detections/endpoint/time_provider_persistence_registry.yml | 1 + .../experimental/endpoint/child_processes_of_spoolsv_exe.yml | 1 + .../experimental/endpoint/print_processor_registry_autostart.yml | 1 + 8 files changed, 8 insertions(+) diff --git a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml index 858f68a065..2c738a2083 100644 --- a/detections/endpoint/msi_module_loaded_by_non_system_binary.yml +++ b/detections/endpoint/msi_module_loaded_by_non_system_binary.yml @@ -39,6 +39,7 @@ references: tags: analytic_story: - Windows Privilege Escalation + - Hermetic Wiper confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml index 5d5fd2ce4c..7892aeb6de 100644 --- a/detections/endpoint/overwriting_accessibility_binaries.yml +++ b/detections/endpoint/overwriting_accessibility_binaries.yml @@ -28,6 +28,7 @@ references: [] tags: analytic_story: - Windows Privilege Escalation + - Hermetic Wiper asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index 9f5e9bb69b..414f1aad14 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -40,6 +40,7 @@ tags: - Suspicious Windows Registry Activities - Cloud Federated Credential Abuse - Windows Registry Abuse + - Hermetic Wiper cis20: - CIS 8 confidence: 95 diff --git a/detections/endpoint/runas_execution_in_commandline.yml b/detections/endpoint/runas_execution_in_commandline.yml index 5dfbcc9a56..3fd74c50d6 100644 --- a/detections/endpoint/runas_execution_in_commandline.yml +++ b/detections/endpoint/runas_execution_in_commandline.yml @@ -31,6 +31,7 @@ references: tags: analytic_story: - Windows Privilege Escalation + - Hermetic Wiper confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml index f6c6c22d88..b32d2605da 100644 --- a/detections/endpoint/screensaver_event_trigger_execution.yml +++ b/detections/endpoint/screensaver_event_trigger_execution.yml @@ -32,6 +32,7 @@ tags: - Windows Persistence Techniques - Windows Privilege Escalation - Windows Registry Abuse + - Hermetic Wiper confidence: 90 context: - Source:Endpoint diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index 515de1811b..44b59e6cc7 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -39,6 +39,7 @@ tags: - Windows Persistence Techniques - Windows Privilege Escalation - Windows Registry Abuse + - Hermetic Wiper confidence: 100 context: - Source:Endpoint diff --git a/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml b/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml index 9f2e0ccd51..e8a6828420 100644 --- a/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml +++ b/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml @@ -28,6 +28,7 @@ references: [] tags: analytic_story: - Windows Privilege Escalation + - Hermetic Wiper asset_type: Endpoint cis20: - CIS 5 diff --git a/detections/experimental/endpoint/print_processor_registry_autostart.yml b/detections/experimental/endpoint/print_processor_registry_autostart.yml index dbfc6288e0..1ef576ee5a 100644 --- a/detections/experimental/endpoint/print_processor_registry_autostart.yml +++ b/detections/experimental/endpoint/print_processor_registry_autostart.yml @@ -32,6 +32,7 @@ tags: analytic_story: - Windows Persistence Techniques - Windows Privilege Escalation + - Hermetic Wiper asset_type: Endpoint confidence: 100 context: