Branch was auto-updated.

.github/workflows/build-and-validate.yml

@@ -147,21 +147,26 @@ jobs:
           source venv/bin/activate
           python3 contentctl.py --path . --verbose generate --product ESCU --output dist/escu
           python3 contentctl.py --path . --verbose generate --product SAAWS --output dist/saaws
+          python3 contentctl.py --path . --verbose generate --product DevSecOps --output dist/devsecops
           #make a copy of use_case_lib in order to have ES work :-(
           cp dist/escu/default/use_case_library.conf dist/escu/default/analyticstories.conf
           cp dist/saaws/default/use_case_library.conf dist/saaws/default/analyticstories.conf
+          cp dist/devsecops/default/use_case_library.conf dist/devsecops/default/analyticstories.conf
 
       - name: Copy lookups .csv files
         run: | 
           # clean up current lookups
           rm -rf dist/escu/lookups
           rm -rf dist/saaws/lookups
+          rm -rf dist/devsecops/lookups
           mkdir dist/escu/lookups
           mkdir dist/saaws/lookups
+          mkdir dist/devsecops/lookups
           #copy over lookups
           cd lookups
           cp -rv *.csv ../dist/escu/lookups
           cp -rv *.csv ../dist/saaws/lookups
+          cp -rv *.csv ../dist/devsecops/lookups
       
       #Tag is '' for non-tagged push and the tag name for a tagged release
       - name: Set tag
@@ -191,13 +196,17 @@ jobs:
             sed -i "s/\"version\": .*$/\"version\": \"$CONTENT_VERSION\"/g" dist/escu/app.manifest
             sed -i "s/version = .*$/version = $CONTENT_VERSION/g" dist/escu/default/content-version.conf
             tar -czf content-pack-build-escu.tar.gz dist/escu/*
+            
             # update build number and version for saaws
             sed -i "s/build = .*$/build = ${{ github.run_number }}/g" dist/saaws/default/app.conf
             sed -i "s/^version = .*$/version = $CONTENT_VERSION/g" dist/saaws/default/app.conf
             sed -i "s/\"version\": .*$/\"version\": \"$CONTENT_VERSION\"/g" dist/saaws/app.manifest
             sed -i "s/version = .*$/version = $CONTENT_VERSION/g" dist/saaws/default/content-version.conf
             tar -czf content-pack-build-saaws.tar.gz dist/saaws/*
-      
+
+            # update build number and version for devsecops
+            tar -czf content-pack-build-devsecops.tar.gz dist/devsecops/*
+
       - name: Persist to Workspace
         uses: actions/upload-artifact@v2
         with:
@@ -205,6 +214,7 @@ jobs:
           path: |
             content-pack-build-escu.tar.gz
             content-pack-build-saaws.tar.gz
+            content-pack-build-devsecops.tar.gz
             
 
   build-package:
@@ -248,10 +258,13 @@ jobs:
           cd build
           tar -zxf content-pack-build-escu.tar.gz
           tar -zxf content-pack-build-saaws.tar.gz
+          tar -zxf content-pack-build-devsecops.tar.gz
           mv dist/escu DA-ESS-ContentUpdate
           mv dist/saaws DA-ESS_AmazonWebServices_Content
+          mv dist/devsecops dev_sec_ops_analytics
           slim package -o upload DA-ESS-ContentUpdate
           slim package -o upload DA-ESS_AmazonWebServices_Content
+          slim package -o upload dev_sec_ops_analytics
 
           cp upload/DA-ESS-ContentUpdate-*.tar.gz DA-ESS-ContentUpdate-latest.tar.gz
           sha256sum DA-ESS-ContentUpdate-latest.tar.gz > checksum.txt
@@ -259,6 +272,10 @@ jobs:
           cp upload/DA-ESS_AmazonWebServices_Content-*tar.gz DA-ESS_AmazonWebServices_Content-latest.tar.gz
           sha256sum DA-ESS_AmazonWebServices_Content-latest.tar.gz >> checksum.txt
 
+          cp upload/dev_sec_ops_analytics-*tar.gz dev_sec_ops_analytics-latest.tar.gz
+
+          touch tag-canary.txt
+
       - name: store_artifacts
         uses: actions/upload-artifact@v2
         with:
@@ -272,6 +289,7 @@ jobs:
           path: |
             build/DA-ESS-ContentUpdate-latest.tar.gz
             build/DA-ESS_AmazonWebServices_Content-latest.tar.gz
+            build/dev_sec_ops_analytics-latest.tar.gz
             build/checksum.txt
       
 

bin/generate.py

@@ -17,6 +17,10 @@ import csv
 import shutil
 
 
+# Global variable
+global_product = 'ESCU'
+
+
 def load_objects(file_path, VERBOSE, REPO_PATH):
     files = []
     manifest_files = path.join(path.expanduser(REPO_PATH), file_path)
@@ -393,6 +397,18 @@ def add_rba(detection):
 
 def prepare_detections(detections, deployments, OUTPUT_PATH):
     for detection in detections:
+        # only for DevSecOps
+        if global_product == 'DevSecOps':
+            if detection['tags']['risk_score']:
+                detection['search'] = detection['search'] + ' | eval risk_score=' + str(detection['tags']['risk_score'])
+
+            if detection['type'] == 'Anomaly':
+                detection['search'] = detection['search'] + ' | collect index=signals'
+            elif detection['type'] == 'TTP':
+                detection['search'] = detection['search'] + ' | collect index=alerts'
+            elif detection['type'] == 'Correlation':
+                detection['search'] = detection['search'] + ' | collect index=alerts'
+
         # parse out data_models
         data_model = parse_data_models_from_search(detection['search'])
         if data_model:
@@ -571,6 +587,11 @@ def compute_objects(objects, PRODUCT, OUTPUT_PATH):
         objects["detections"]  = [object for object in objects["detections"]  if 'Splunk Security Analytics for AWS' in object['tags']['product']]
         objects["stories"] = [object for object in objects["stories"] if 'Splunk Security Analytics for AWS' in object['tags']['product']]
 
+    if PRODUCT == "DevSecOps":
+        objects["detections"]  = [object for object in objects["detections"]  if 'Dev Sec Ops Analytics' in object['tags']['product']]
+        objects["stories"] = [object for object in objects["stories"] if 'Dev Sec Ops Analytics' in object['tags']['product']]
+
+
     # only use ESCU detections to the configurations
     objects["detections"] = sorted(filter(lambda d: not 'Splunk Behavioral Analytics' in d['tags']['product'], objects["detections"]), key=lambda d: d['name'])
     # only use ESCU stories to the configuration
@@ -589,7 +610,8 @@ def get_objects(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
     return objects
 
 def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
-
+    global global_product
+    global_product = PRODUCT
     TEMPLATE_PATH = path.join(REPO_PATH, 'bin/jinja2_templates')
 
     objects = get_objects(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE)

detections/cloud/aws_ecr_container_scanning_findings_high.yml

@@ -12,10 +12,11 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF
   | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand
   findings | spath input=findings| search severity=HIGH | rename name as finding_name,
   description as finding_description, requestParameters.imageId.imageDigest as imageDigest,
-  requestParameters.repositoryName as repositoryName | eval finding = finding_name.",
-  ".finding_description | stats min(_time) as firstTime max(_time) as lastTime by
-  awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName,
-  src_ip, finding | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  requestParameters.repositoryName as image | eval finding = finding_name.",
+  ".finding_description | eval phase="release" | eval severity="high"  
+  | stats min(_time) as firstTime max(_time) as lastTime by
+  awsRegion, eventName, eventSource, imageDigest, image, user, userName,
+  src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `aws_ecr_container_scanning_findings_high_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.
@@ -28,11 +29,11 @@ tags:
   asset_type: AWS Account
   cis20:
   - CIS 13
-  confidence: 70
+  confidence: 100
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
-  message: Vulnerabilities with severity high found in repository $repositoryName$
+  message: Vulnerabilities with severity high found in image $image$
   mitre_attack_id:
   - T1204.003
   nist:
@@ -40,7 +41,7 @@ tags:
   - PR.AC
   - DE.CM
   observable:
-  - name: repositoryName
+  - name: image
     type: System
     role:
     - Victim
@@ -48,6 +49,7 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  - Dev Sec Ops Analytics
   required_fields:
   - eventSource
   - eventName
@@ -58,5 +60,5 @@ tags:
   - user
   - userName
   - src_ip
-  risk_score: 49
+  risk_score: 70
   security_domain: network

detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml

@@ -13,9 +13,9 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF
   findings | spath input=findings| search severity IN (LOW, INFORMATIONAL, UNKNWON)
   | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest
   as imageDigest, requestParameters.repositoryName as repositoryName | eval finding
-  = finding_name.", ".finding_description | stats min(_time) as firstTime max(_time)
+  = finding_name.", ".finding_description | eval phase="release" | eval severity="low" | stats min(_time) as firstTime max(_time)
   as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user,
-  userName, src_ip, finding | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `aws_ecr_container_scanning_findings_low_informational_unknown_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.
@@ -29,7 +29,7 @@ tags:
   cis20:
   - CIS 13
   confidence: 70
-  impact: 70
+  impact: 10
   kill_chain_phases:
   - Actions on Objectives
   message: Vulnerabilities with severity high found in repository $repositoryName$
@@ -48,6 +48,7 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  - Dev Sec Ops Analytics
   required_fields:
   - eventSource
   - eventName
@@ -58,5 +59,5 @@ tags:
   - user
   - userName
   - src_ip
-  risk_score: 49
+  risk_score: 7
   security_domain: network

detections/cloud/aws_ecr_container_scanning_findings_medium.yml

@@ -12,10 +12,11 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF
   | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand
   findings | spath input=findings| search severity=MEDIUM | rename name as finding_name,
   description as finding_description, requestParameters.imageId.imageDigest as imageDigest,
-  requestParameters.repositoryName as repositoryName | eval finding = finding_name.",
-  ".finding_description | stats min(_time) as firstTime max(_time) as lastTime by
-  awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName,
-  src_ip, finding | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  requestParameters.repositoryName as image | eval finding = finding_name.",
+  ".finding_description | eval phase="release" | eval severity="medium"  
+  | stats min(_time) as firstTime max(_time) as lastTime by
+  awsRegion, eventName, eventSource, imageDigest, image, user, userName,
+  src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `aws_ecr_container_scanning_findings_medium_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.
@@ -29,10 +30,10 @@ tags:
   cis20:
   - CIS 13
   confidence: 70
-  impact: 70
+  impact: 30
   kill_chain_phases:
   - Actions on Objectives
-  message: Vulnerabilities with severity high found in repository $repositoryName$
+  message: Vulnerabilities with severity high found in image $image$
   mitre_attack_id:
   - T1204.003
   nist:
@@ -40,7 +41,7 @@ tags:
   - PR.AC
   - DE.CM
   observable:
-  - name: repositoryName
+  - name: image
     type: System
     role:
     - Victim
@@ -48,6 +49,7 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  - Dev Sec Ops Analytics
   required_fields:
   - eventSource
   - eventName
@@ -58,5 +60,5 @@ tags:
   - user
   - userName
   - src_ip
-  risk_score: 49
+  risk_score: 21
   security_domain: network

detections/cloud/aws_ecr_container_upload_outside_business_hours.yml

@@ -10,8 +10,9 @@ description: This search looks for AWS CloudTrail events from AWS Elastic Contai
   When done outside business hours, we want to take a look into it.
 search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage date_hour>=20
   OR date_hour<8 NOT (date_wday=saturday OR date_wday=sunday) | rename requestParameters.*
-  as * | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName,
-  eventSource, user, userName, src_ip, imageTag, registryId, repositoryName | `security_content_ctime(firstTime)`
+  as * | rename repositoryName AS image | eval phase="release" | eval severity="medium" 
+  | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName,
+  eventSource, user, userName, src_ip, imageTag, registryId, image, phase, severity | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `aws_ecr_container_upload_outside_business_hours_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.
@@ -49,6 +50,7 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  - Dev Sec Ops Analytics
   required_fields:
   - eventSource
   - eventName

detections/cloud/aws_ecr_container_upload_unknown_user.yml

@@ -10,9 +10,10 @@ description: This search looks for AWS CloudTrail events from AWS Elastic Contai
   users. When the user was never seen before, we should have a closer look into the
   event.
 search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage NOT `aws_ecr_users`
-  | rename requestParameters.* as * | stats min(_time) as firstTime max(_time) as
+  | rename requestParameters.* as * | rename repositoryName AS image | eval phase="release" 
+  | eval severity="high" | stats min(_time) as firstTime max(_time) as
   lastTime by awsRegion, eventName, eventSource, user, userName, src_ip, imageTag,
-  registryId, repositoryName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  registryId, image, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `aws_ecr_container_upload_unknown_user_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.
@@ -49,6 +50,7 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  - Dev Sec Ops Analytics
   required_fields:
   - eventSource
   - eventName

detections/cloud/aws_excessive_security_scanning.yml

@@ -58,6 +58,7 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  - Dev Sec Ops Analytics
   required_fields:
   - _time
   - eventName

detections/cloud/circle_ci_disable_security_job.yml

@@ -7,11 +7,12 @@ type: Anomaly
 datamodel: []
 description: This search looks for disable security job in CircleCI pipeline.
 search: '`circleci` | rename vcs.committer_name as user vcs.subject as commit_message
-  vcs.url as url workflows.* as * | stats values(job_name) as job_names by workflow_id
+  vcs.url as url workflows.* as *  | stats values(job_name) as job_names by workflow_id
   workflow_name user commit_message url branch | lookup mandatory_job_for_workflow
   workflow_name OUTPUTNEW job_name AS mandatory_job | search mandatory_job=* | eval
   mandatory_job_executed=if(like(job_names, "%".mandatory_job."%"), 1, 0) | where
-  mandatory_job_executed=0 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  mandatory_job_executed=0 | rex field=url "(?<repository>[^\/]*\/[^\/]*)$" 
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `circle_ci_disable_security_job_filter`'
 how_to_implement: You must index CircleCI logs.
 known_false_positives: unknown

detections/cloud/circle_ci_disable_security_step.yml

@@ -11,7 +11,8 @@ search: '`circleci` | rename workflows.job_id AS job_id | join job_id [ | search
   job_id job_name vcs.committer_name vcs.subject vcs.url owners{} | rename vcs.* as
   * , owners{} as user | lookup mandatory_step_for_job job_name OUTPUTNEW step_name
   AS mandatory_step | search mandatory_step=* | eval mandatory_step_executed=if(like(step_names,
-  "%".mandatory_step."%"), 1, 0) | where mandatory_step_executed=0 | `security_content_ctime(firstTime)`
+  "%".mandatory_step."%"), 1, 0) | where mandatory_step_executed=0
+  | rex field=url "(?<repository>[^\/]*\/[^\/]*)$"  | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `circle_ci_disable_security_step_filter`'
 how_to_implement: You must index CircleCI logs.
 known_false_positives: unknown

detections/cloud/correlation_by_repository_and_risk.yml

@@ -0,0 +1,46 @@
+name: Correlation by Repository and Risk
+id: 8da9fdd9-6a1b-4ae0-8a34-8c25e6be9687
+version: 1
+date: '2021-09-06'
+author: Patrick Bareiss, Splunk
+type: Correlation
+datamodel: []
+description: This search correlations detections by repository and risk_score
+search: '`signals` | fillnull 
+  | stats sum(risk_score) as risk_score values(source) as signals values(user) as user by repository 
+  | sort - risk_score | where risk_score > 80
+  | `correlation_by_repository_and_risk_filter`'
+how_to_implement: For Dev Sec Ops POC
+known_false_positives: unknown
+references: []
+tags:
+  analytic_story:
+  - Dev Sec Ops
+  asset_type: AWS Account
+  cis20:
+  - CIS 13
+  confidence: 100
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Correlation triggered for user $user$
+  mitre_attack_id:
+  - T1204.003
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Dev Sec Ops Analytics
+  required_fields:
+  - _time
+  risk_score: 70
+  security_domain: network

detections/cloud/correlation_by_user_and_risk.yml

@@ -0,0 +1,46 @@
+name: Correlation by User and Risk
+id: 610e12dc-b6fa-4541-825e-4a0b3b6f6773
+version: 1
+date: '2021-09-06'
+author: Patrick Bareiss, Splunk
+type: Correlation
+datamodel: []
+description: This search correlations detections by user and risk_score
+search: '`signals` | fillnull 
+  | stats sum(risk_score) as risk_score values(source) as signals values(repository) as repository by user 
+  | sort - risk_score | where risk_score > 80
+  | `correlation_by_user_and_risk_filter`'
+how_to_implement: For Dev Sec Ops POC
+known_false_positives: unknown
+references: []
+tags:
+  analytic_story:
+  - Dev Sec Ops
+  asset_type: AWS Account
+  cis20:
+  - CIS 13
+  confidence: 100
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Correlation triggered for user $user$
+  mitre_attack_id:
+  - T1204.003
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Dev Sec Ops Analytics
+  required_fields:
+  - _time
+  risk_score: 70
+  security_domain: network

detections/cloud/github_commit_changes_in_master.yml

@@ -10,9 +10,9 @@ description: This search is to detect a pushed or commit to master or main branc
   Ideally in terms of devsecops the changes made in a branch and do a PR for review.
   of course in some cases admin of the project may did a changes directly to master
   branch
-search: '`github` branches{}.name = main OR branches{}.name = master |  stats count
+search: '`github` branches{}.name = main OR branches{}.name = master | eval severity="low" | eval phase="code" |  stats count
   min(_time) as firstTime max(_time) as lastTime  by commit.author.html_url commit.commit.author.email
-  commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date
+  commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date, phase, severity
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_commit_changes_in_master_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs related to github logs having the fork, commit, push metadata that can be use
@@ -45,6 +45,7 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  - Dev Sec Ops Analytics
   required_fields:
   - _time
   risk_score: 9

detections/cloud/github_commit_in_develop.yml

@@ -43,6 +43,7 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  - Dev Sec Ops Analytics
   required_fields:
   - _time
   risk_score: 9

detections/cloud/github_dependabot_alert.yml

@@ -7,10 +7,10 @@ type: Anomaly
 datamodel: []
 description: This search looks for Dependabot Alerts in Github logs.
 search: '`github` alert.id=* action=create | rename repository.full_name as repository,
-  repository.html_url as repository_url | stats min(_time) as firstTime max(_time)
+  repository.html_url as repository_url sender.login as user | stats min(_time) as firstTime max(_time)
   as lastTime by action alert.affected_package_name alert.affected_range alert.created_at
   alert.external_identifier alert.external_reference alert.fixed_in alert.severity
-  repository repository_url | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  repository repository_url user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `github_dependabot_alert_filter`'
 how_to_implement: You must index GitHub logs. You can follow the url in reference
   to onboard GitHub logs.

detections/cloud/github_pull_request_from_unknown_user.yml

@@ -7,11 +7,12 @@ type: Anomaly
 datamodel: []
 description: This search looks for Pull Request from unknown user.
 search: '`github` check_suite.pull_requests{}.id=* | stats count by check_suite.head_commit.author.name
-  check_suite.pull_requests{}.base.repo.name check_suite.pull_requests{}.head.ref
+  repository.full_name check_suite.pull_requests{}.head.ref
   check_suite.head_commit.message | rename check_suite.head_commit.author.name as
-  user check_suite.pull_requests{}.base.repo.name as repository check_suite.pull_requests{}.head.ref
+  user repository.full_name as repository check_suite.pull_requests{}.head.ref
   as ref_head check_suite.head_commit.message as commit_message | search NOT `github_known_users`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_pull_request_from_unknown_user_filter`'
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` 
+  | `github_pull_request_from_unknown_user_filter`'
 how_to_implement: You must index GitHub logs. You can follow the url in reference
   to onboard GitHub logs.
 known_false_positives: unknown

detections/cloud/gsuite_drive_share_in_external_email.yml

@@ -10,10 +10,10 @@ description: This search is to detect suspicious google drive or google docs fil
   exfitration of data made by an attacker or insider to a targetted machine.
 search: '`gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner "[^@]+@(?<src_domain>[^@]+)"
   | rex field=email "[^@]+@(?<dest_domain>[^@]+)" | where src_domain = "internal_test_email.com"
-  and not dest_domain = "internal_test_email.com" | stats values(parameters.doc_title)
+  and not dest_domain = "internal_test_email.com" | eval phase="plan" | eval severity="low" | stats values(parameters.doc_title)
   as doc_title, values(parameters.doc_type) as doc_types, values(email) as dst_email_list,
   values(parameters.visibility) as visibility, count min(_time) as firstTime max(_time)
-  as lastTime by parameters.owner | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  as lastTime by parameters.owner phase severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `gsuite_drive_share_in_external_email_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs related to gsuite having the file attachment metadata like file type, file
@@ -50,6 +50,7 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  - Dev Sec Ops Analytics
   required_fields:
   - _time
   - parameters.doc_title

detections/cloud/gsuite_email_suspicious_attachment.yml

@@ -12,10 +12,11 @@ description: This search is to detect a suspicious attachment file extension in
   file type that maybe send by employee or network admin.
 search: '`gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb", "sh",
   "bat", "exe", "dll", "cpl", "com", "js", "vbs", "ps1", "reg","swf", "cmd", "go")
+  | eval phase="plan" | eval severity="medium"
   | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type)
   as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size)
   as payload_size by destination{}.service num_message_attachments  subject destination{}.address
-  source.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  source.address phase severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `gsuite_email_suspicious_attachment_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs related to gsuite having the file attachment metadata like file type, file
@@ -53,6 +54,7 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  - Dev Sec Ops Analytics
   required_fields:
   - _time
   - attachment{}.file_extension_type

detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml

@@ -19,11 +19,11 @@ search: '`gsuite_gmail` num_message_attachments > 0 subject IN ("*dhl*", "* ups
   IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar", "html","htm","hta")
   | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address
   "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com"
-  and dest_domain="internal_test_email.com" | stats count min(_time) as firstTime
+  and dest_domain="internal_test_email.com" | eval phase="plan" | eval severity="medium" | stats count min(_time) as firstTime
   max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments,
   values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size
   by destination{}.service num_message_attachments  subject destination{}.address
-  source.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  source.address phase severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `gsuite_email_suspicious_subject_with_attachment_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs related to gsuite having the file attachment metadata like file type, file
@@ -49,20 +49,18 @@ tags:
   message: suspicious email from $source.address$ to $destination{}.address$
   mitre_attack_id:
   - T1566.001
-  observable:
-  - name: source.address
-    type: User
-    role:
-    - attacker
-  - name: destination{}.address
-    type: User
-    role:
-    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  - Dev Sec Ops Analytics
   required_fields:
   - _time
-  risk_score: 25
   security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: suspicious email from $source.address$ to $destination{}.address$

detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml

@@ -12,9 +12,9 @@ description: This analytics is to detect a gmail containing a link that are know
 search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me")
   | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address
   "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com"
-  and dest_domain="internal_test_email.com" |stats values(link_domain{}) as link_domains
+  and dest_domain="internal_test_email.com" | eval phase="plan" | eval severity="low" |stats values(link_domain{}) as link_domains
   min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address
-  subject destination{}.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  subject destination{}.address phase severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `gsuite_email_with_known_abuse_web_service_link_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs related to gsuite having the file attachment metadata like file type, file
@@ -39,20 +39,18 @@ tags:
   message: suspicious email from $source.address$ to $destination{}.address$
   mitre_attack_id:
   - T1566.001
-  observable:
-  - name: source.address
-    type: User
-    role:
-    - attacker
-  - name: destination{}.address
-    type: User
-    role:
-    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  - Dev Sec Ops Analytics
   required_fields:
   - _time
-  risk_score: 25
   security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: suspicious email from $source.address$ to $destination{}.address$

detections/cloud/gsuite_outbound_email_with_attachment_to_external_domain.yml

@@ -12,9 +12,10 @@ description: This search is to detect a suspicious outbound e-mail from internal
 search: '`gsuite_gmail` num_message_attachments > 0 | rex field=source.from_header_address
   "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"
   | where source_domain="internal_test_email.com" and not dest_domain="internal_test_email.com"
+  | eval phase="plan" | eval severity="low"
   | stats values(subject) as subject, values(source.from_header_address) as src_domain_list,
   count as numEvents, dc(source.from_header_address) as numSrcAddresses, min(_time)
-  as firstTime max(_time) as lastTime by dest_domain | where numSrcAddresses < 20
+  as firstTime max(_time) as lastTime by dest_domain phase severity | where numSrcAddresses < 20
   |sort - numSrcAddresses | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `gsuite_outbound_email_with_attachment_to_external_domain_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
@@ -53,6 +54,7 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  - Dev Sec Ops Analytics
   required_fields:
   - _time
   risk_score: 9

detections/cloud/gsuite_suspicious_shared_file_name.yml

@@ -17,9 +17,9 @@ search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_tit
   "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet",
   "presentation") | rex field=parameters.owner "[^@]+@(?<source_domain>[^@]+)" | rex
   field=parameters.target_user "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com"
-  and dest_domain="internal_test_email.com" | stats count min(_time) as firstTime
+  and dest_domain="internal_test_email.com" | eval phase="plan" | eval severity="low" | stats count min(_time) as firstTime
   max(_time) as lastTime by email parameters.owner parameters.target_user parameters.doc_title
-  parameters.doc_type | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  parameters.doc_type phase severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `gsuite_suspicious_shared_file_name_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs related to gsuite having the file attachment metadata like file type, file
@@ -58,6 +58,7 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  - Dev Sec Ops Analytics
   required_fields:
   - _time
   - parameters.doc_title

detections/cloud/kubernetes_nginx_ingress_lfi.yml

@@ -11,8 +11,9 @@ search: '`kubernetes_container_controller` | rex field=_raw "^(?<remote_addr>\S+
   | lookup local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT
   lfi_path | search lfi_path=yes | rename remote_addr AS src_ip, upstream_status as
   status, proxy_upstream_name as proxy | rex field=request "^(?<http_method>\S+)\s(?<url>\S+)\s"
+  | eval phase="operate" | eval severity="high"
   | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status,
-  url, http_method, host, http_user_agent, proxy | `security_content_ctime(firstTime)`
+  url, http_method, host, http_user_agent, proxy, phase, severity | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter`'
 how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
 known_false_positives: unknown
@@ -48,6 +49,7 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  - Dev Sec Ops Analytics
   required_fields:
   - raw
   risk_score: 49

detections/cloud/kubernetes_nginx_ingress_rfi.yml

@@ -10,8 +10,8 @@ description: This search uses the Kubernetes logs from a nginx ingress controlle
 search: '`kubernetes_container_controller` | rex field=_raw "^(?<remote_addr>\S+)\s+-\s+-\s+\[(?<time_local>[^\]]*)\]\s\"(?<request>[^\"]*)\"\s(?<status>\S*)\s(?<body_bytes_sent>\S*)\s\"(?<http_referer>[^\"]*)\"\s\"(?<http_user_agent>[^\"]*)\"\s(?<request_length>\S*)\s(?<request_time>\S*)\s\[(?<proxy_upstream_name>[^\]]*)\]\s\[(?<proxy_alternative_upstream_name>[^\]]*)\]\s(?<upstream_addr>\S*)\s(?<upstream_response_length>\S*)\s(?<upstream_response_time>\S*)\s(?<upstream_status>\S*)\s(?<req_id>\S*)"
   | rex field=request "^(?<http_method>\S+)?\s(?<url>\S+)\s" | rex field=url "(?<dest_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
   | search dest_ip=* | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name
-  as proxy | stats count min(_time) as firstTime max(_time) as lastTime by src_ip,
-  dest_ip status, url, http_method, host, http_user_agent, proxy | `security_content_ctime(firstTime)`
+  as proxy | eval phase="operate" | eval severity="medium" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip,
+  dest_ip status, url, http_method, host, http_user_agent, proxy, phase, severity | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_rfi_filter`'
 how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
 known_false_positives: unknown
@@ -47,6 +47,7 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  - Dev Sec Ops Analytics
   required_fields:
   - raw
   risk_score: 49

detections/cloud/kubernetes_scanner_image_pulling.yml

@@ -10,8 +10,9 @@ description: This search uses the Kubernetes logs from Splunk Connect from Kuber
 search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling
   image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*")
   | rename object.* AS * | rename involvedObject.* AS * | rename source.host AS host
+  | eval phase="operate" | eval severity="high"
   | stats min(_time) as firstTime max(_time) as lastTime count by host, name, namespace,
-  kind, reason, message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  kind, reason, message, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `kubernetes_scanner_image_pulling_filter`'
 how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
 known_false_positives: unknown
@@ -24,10 +25,10 @@ tags:
   automated_detection_testing: passed
   cis20:
   - CIS 13
-  confidence: 70
+  confidence: 90
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_kube_hunter/kubernetes_kube_hunter.json
-  impact: 70
+  impact: 90
   kill_chain_phases:
   - Actions on Objectives
   message: Kubernetes Scanner image pulled on host $host$
@@ -44,6 +45,7 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  - Dev Sec Ops Analytics
   required_fields:
   - object.message
   - source.host
@@ -52,5 +54,5 @@ tags:
   - object.involvedObject.kind
   - object.message
   - object.reason
-  risk_score: 49
+  risk_score: 81
   security_domain: network

dist/devsecops/bin/README

@@ -0,0 +1 @@
+This is where you put any scripts you want to add to this app.

dist/devsecops/default/analytic_stories.conf

@@ -0,0 +1,27 @@
+#############
+# Automatically generated by generator.py in splunk/security_content
+# On Date: 2021-08-27T14:41:52 UTC
+# Author: Splunk Security Research
+# Contact: research@splunk.com
+#############
+
+### STORIES ###
+
+[Dev Sec Ops]
+category =  Cloud Security
+creation_date = 2021-08-18
+modification_date = 2021-08-18
+id = 0ca8c38e-631e-4b81-940c-f9c5450ce41e
+version = 1
+reference = ["https://www.redhat.com/en/topics/devops/what-is-devsecops"]
+detection_searches = ["ESCU - AWS ECR Container Scanning Findings High - Rule", "ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule", "ESCU - AWS ECR Container Scanning Findings Medium - Rule", "ESCU - AWS ECR Container Upload Outside Business Hours - Rule", "ESCU - AWS ECR Container Upload Unknown User - Rule", "ESCU - Kubernetes Nginx Ingress LFI - Rule", "ESCU - Kubernetes Nginx Ingress RFI - Rule", "ESCU - Kubernetes Scanner Image Pulling - Rule"]
+mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1212", "T1526"], "nist": ["DE.CM", "PR.AC", "PR.DS"]}
+investigative_searches = []
+support_searches = []
+data_models = []
+providing_technologies = none
+description = This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor.
+narrative = DevSecOps is a collaborative framework, which thinks about application and infrastructure security from the start. This means that security tools are part of the continuous integration and continuous deployment pipeline. In this analytics story, we focused on detections around the tools used in this framework such as GitHub as a version control system, GDrive for the documentation, CircleCI as the CI/CD pipeline, Kubernetes as the container execution engine and multiple security tools such as Semgrep and Kube-Hunter.
+product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud', 'Dev Sec Ops Analytics']
+
+#### END STORIES ####

dist/devsecops/default/app.conf

@@ -0,0 +1,16 @@
+#
+# Splunk app configuration file
+#
+
+[install]
+is_configured = 0
+
+[ui]
+is_visible = 1
+label = Dev Sec Ops Analytics
+
+[launcher]
+author = Splunk Threat Research Team
+description = 
+version = 1.0.0
+

dist/devsecops/default/collections.conf

@@ -0,0 +1,55 @@
+#############
+# Automatically generated by generator.py in splunk/security_content
+# On Date: 2021-08-27T14:41:52 UTC
+# Author: Splunk Security Research
+# Contact: research@splunk.com
+#############
+
+[api_call_by_user_baseline]
+enforceTypes = false
+replicate = false
+
+[cloud_instances_enough_data]
+enforceTypes = false
+replicate = false
+
+[previously_seen_cloud_api_calls_per_user_role]
+enforceTypes = false
+replicate = false
+
+[previously_seen_cloud_compute_creations_by_user]
+enforceTypes = false
+replicate = false
+
+[previously_seen_cloud_compute_images]
+enforceTypes = false
+replicate = false
+
+[previously_seen_cloud_compute_instance_types]
+enforceTypes = false
+replicate = false
+
+[previously_seen_cloud_instance_modifications_by_user]
+enforceTypes = false
+replicate = false
+
+[previously_seen_cloud_provisioning_activity_sources]
+enforceTypes = false
+replicate = false
+
+[previously_seen_cloud_regions]
+enforceTypes = false
+replicate = false
+
+[previously_seen_running_windows_services]
+enforceTypes = false
+replicate = false
+
+[previously_seen_users_console_logins]
+enforceTypes = false
+replicate = false
+
+[zoom_first_time_child_process]
+enforceTypes = false
+replicate = false
+

dist/devsecops/default/data/ui/nav/default.xml

@@ -0,0 +1,7 @@
+<nav search_view="search">
+  <view name="analytics" default='true' />
+  <view name="user_analytics" />
+  <view name="repository_analytics" />
+  <view name="search" />
+  <view name="dashboards" />
+</nav>

dist/devsecops/default/data/ui/views/README

@@ -0,0 +1 @@
+Add all the views that your app needs in this directory

dist/devsecops/default/es_investigations.conf

@@ -0,0 +1,10 @@
+
+[panel_group://workbench_panel_group_dev_sec_ops]
+label = Dev Sec Ops
+description = This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor.
+disabled = 0
+
+panels = ["panel://workbench_panel_get_notable_history___response_task"]
+
+
+

dist/devsecops/default/macros.conf

@@ -0,0 +1,405 @@
+#############
+# Automatically generated by generator.py in splunk/security_content
+# On Date: 2021-08-27T14:41:52 UTC
+# Author: Splunk Security Research
+# Contact: research@splunk.com
+#############
+
+
+[aws_cloudwatchlogs_eks]
+definition = sourcetype="aws:cloudwatchlogs:eks"
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[aws_config]
+definition = sourcetype=aws:config
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[aws_description]
+definition = sourcetype="aws:description"
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[aws_ecr_users]
+definition = userName IN (user)
+description = specify the user allowed to push Images to AWS ECR.
+
+[aws_s3_accesslogs]
+definition = sourcetype=aws:s3:accesslogs
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[aws_securityhub_finding]
+definition = sourcetype="aws:securityhub:finding"
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[aws_securityhub_firehose]
+definition = sourcetype="aws:securityhub:firehose"
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[brand_abuse_dns]
+definition = lookup update=true brandMonitoring_lookup domain as query OUTPUT domain_abuse | search domain_abuse=true
+description = This macro limits the output to only domains that are in the brand monitoring lookup file
+
+[brand_abuse_email]
+definition = lookup update=true brandMonitoring_lookup domain as src_user OUTPUT domain_abuse | search domain_abuse=true
+description = This macro limits the output to only domains that are in the brand monitoring lookup file
+
+[brand_abuse_web]
+definition = lookup update=true brandMonitoring_lookup domain as urls OUTPUT domain_abuse | search domain_abuse=true
+description = This macro limits the output to only domains that are in the brand monitoring lookup file
+
+[cisco_networks]
+definition = eventtype=cisco_ios
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[cloud_api_calls_from_previously_unseen_user_roles_activity_window]
+definition = "-70m@m"
+description = Use this macro to determine how far back you should be checking for new commands from user roles
+
+[cloudtrail]
+definition = sourcetype=aws:cloudtrail
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[cloudwatch_eks]
+definition = sourcetype="aws:cloudwatchlogs:eks"
+description = customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch eks logs. Replace the macro definition with configurations for your Splunk Environmnent.
+
+[cloudwatch_vpc]
+definition = sourcetype=aws:cloudwatchlogs:vpcflow
+description = customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch vpc logs. Replace the macro definition with configurations for your Splunk Environmnent.
+
+[cloudwatchlogs_vpcflow]
+definition = sourcetype=aws:cloudwatchlogs:vpcflow
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[dynamic_dns_providers]
+definition = lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True
+description = This macro limits the output of the query field to dynamic dns domains. It looks up the domains in a file provided by Splunk and one intended to be updated by the end user.
+
+[dynamic_dns_web_traffic]
+definition = lookup update=true dynamic_dns_providers_default dynamic_dns_domains as url OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as url OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True
+description = This is a description
+
+[ec2_modification_api_calls]
+definition = (eventName=AssociateAddress OR eventName=AssociateIamInstanceProfile OR eventName=AttachClassicLinkVpc OR eventName=AttachNetworkInterface OR eventName=AttachVolume OR eventName=BundleInstance OR eventName=DetachClassicLinkVpc OR eventName=DetachVolume OR eventName=ModifyInstanceAttribute OR eventName=ModifyInstancePlacement OR eventName=MonitorInstances OR eventName=RebootInstances OR eventName=ResetInstanceAttribute OR eventName=StartInstances OR eventName=StopInstances OR eventName=TerminateInstances OR eventName=UnmonitorInstances)
+description = This is a list of AWS event names that have to do with modifying Amazon EC2 instances
+
+[evilginx_phishlets_0365]
+definition = (query=login* AND query=www*)
+description = This limits the query fields to domains that are associated with evilginx masquerading as Office 365
+
+[evilginx_phishlets_amazon]
+definition = (query=fls-na* AND query = www* AND query=images*)
+description = This limits the query fields to domains that are associated with evilginx masquerading as Amazon
+
+[evilginx_phishlets_aws]
+definition = (query=www* AND query=aws* AND query=console.aws* AND query=signin.aws* AND api-northeast-1.console.aws* AND query=fls-na* AND query=images-na*)
+description = This limits the query fields to domains that are associated with evilginx masquerading as an AWS console
+
+[evilginx_phishlets_facebook]
+definition = (query=www* AND query = m* AND query=static*)
+description = This limits the query fields to domains that are associated with evilginx masquerading as FaceBook
+
+[evilginx_phishlets_github]
+definition = (query=api* AND query = github*)
+description = This limits the query fields to domains that are associated with evilginx masquerading as GitHub
+
+[evilginx_phishlets_google]
+definition = (query=accounts* AND query=ssl* AND query=www*)
+description = This limits the query fields to domains that are associated with evilginx masquerading as Google
+
+[evilginx_phishlets_outlook]
+definition = (query=outlook* AND query=login* AND query=account*)
+description = This limits the query fields to domains that are associated with evilginx masquerading as Outlook
+
+[f5_bigip_rogue]
+definition = index=netops sourcetype="f5:bigip:rogue"
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[filter_rare_process_allow_list]
+definition = lookup update=true lookup_rare_process_allow_list_default process as process OUTPUTNEW allow_list | where allow_list="false" | lookup update=true lookup_rare_process_allow_list_local process as process OUTPUT allow_list | where allow_list="false"
+description = This macro is intended to allow_list processes that have been definied as rare
+
+[github]
+definition = sourcetype=aws:firehose:json
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[google_gcp_pubnet_message]
+definition = sourcetype="google:gcp:pubsub:message"
+description = customer specific splunk configurations(eg- index, source, sourcetype) for Google GCP. Replace the macro definition with configurations for your Splunk Environmnent.
+
+[google_gcp_pubsub_message]
+definition = sourcetype="google:gcp:pubsub:message"
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[gsuite_drive]
+definition = sourcetype=gsuite:drive:json
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[gsuite_gmail]
+definition = sourcetype=gsuite:gmail:bigquery
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[is_windows_system_file]
+definition = lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true
+description = This macro limits the output to process names that are in the Windows System directory
+
+[kube_objects_events]
+definition = sourcetype=kube:objects:events
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[kubernetes_azure]
+definition = sourcetype=mscs:storage:blob:json
+description = customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data from Azure. Replace the macro definition with configurations for your Splunk Environmnent.
+
+[kubernetes_container_controller]
+definition = sourcetype=kube:container:controller
+description = customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data. Replace the macro definition with configurations for your Splunk Environmnent.
+
+[linux_hosts]
+definition = index=*
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[netbackup]
+definition = sourcetype="netbackup_logs"
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[network_acl_events]
+definition = (eventName = CreateNetworkAcl OR eventName = CreateNetworkAclEntry OR eventName = DeleteNetworkAcl OR eventName = DeleteNetworkAclEntry OR eventName = ReplaceNetworkAclEntry OR eventName = ReplaceNetworkAclAssociation)
+description = This is a list of AWS event names that are associated with Network ACLs
+
+[notable]
+definition = index=notable
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[o365_management_activity]
+definition = sourcetype=o365:management:activity
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[okta]
+definition = eventtype=okta_log
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[osquery_process]
+definition = eventtype="osquery-process"
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[powershell]
+definition = (source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational")
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[previously_seen_cloud_api_calls_per_user_role_forget_window]
+definition = "-90d@d"
+description = Use this macro to determine how long to keep track of cloud api calls per user role
+
+[previously_seen_cloud_compute_creations_by_user_search_window_begin_offset]
+definition = "-70m@m"
+description = Use this macro to determine how far into the past the window should be to determine if the user is new or not
+
+[previously_seen_cloud_compute_image_search_window_begin_offset]
+definition = "-70m@m"
+description = Use this macro to determine how far into the past the window should be to determine if the image is new or not
+
+[previously_seen_cloud_compute_images_forget_window]
+definition = "-90d@d"
+description = Use this macro to determine how long to keep track of cloud instance images
+
+[previously_seen_cloud_compute_instance_type_forget_window]
+definition = "-90d@d"
+description = Use this macro to determine how long to keep track of cloud instance types
+
+[previously_seen_cloud_compute_instance_types_search_window_begin_offset]
+definition = "-70m@m"
+description = Use this macro to determine how far into the past the window should be to determine if the instance type is new or not
+
+[previously_seen_cloud_instance_modifications_by_user_search_window_begin_offset]
+definition = "-70m@m"
+description = Use this macro to determine how far into the past the window should be to determine if the user is new or not
+
+[previously_seen_cloud_provisioning_activity_forget_window]
+definition = "-90d@d"
+description = Use this macro to determine how long to keep track of cloud provisioning locations
+
+[previously_seen_cloud_region_forget_window]
+definition = "-90d@d"
+description = Use this macro to determine how long to keep track of cloud regions
+
+[previously_seen_cloud_regions_search_window_begin_offset]
+definition = "-70m@m"
+description = Use this macro to determine how far into the past the window should be to determine if the region is new or not
+
+[previously_seen_windows_services_forget_window]
+definition = "-90d@d"
+description = Use this macro to determine how long to keep track of Windows services
+
+[previously_seen_windows_services_window]
+definition = "-70m@m"
+description = Use this macro to determine how far back you should be checking for new Windows services
+
+[previously_seen_zoom_child_processes_forget_window]
+definition = "-90d@d"
+description = Use this macro to determine how long to keep track of zoom child processes
+
+[previously_seen_zoom_child_processes_window]
+definition = "-70m@m"
+description = Use this macro to determine how far back you should be checking for new zoom child processes
+
+[previously_unseen_cloud_provisioning_activity_window]
+definition = "-70m@m"
+description = Use this macro to determine how far back you should be checking for new provisioning activities
+
+[printservice]
+definition = source="wineventlog:microsoft-windows-printservice/operational" OR sourcetype="WinEventLog:Microsoft-Windows-PrintService/Admin"
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[process_esentutl]
+definition = (Processes.process_name=esentutl.exe OR Processes.original_file_name=esentutl.exe)
+description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+
+[prohibited_apps_launching_cmd]
+definition = | inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name="*" . parent_process_name | table parent_process_name
+description = This macro outputs a list of process that should not be the parent process of cmd.exe
+
+[prohibited_softwares]
+definition = lookup prohibited_softwares app as process_name OUTPUT is_prohibited | search is_prohibited=True
+description = This macro limits the output to process_names that have been marked as prohibited
+
+[ransomware_extensions]
+definition = lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Name | search Name !=False
+description = This macro limits the output to files that have extensions associated with ransomware
+
+[ransomware_notes]
+definition = lookup ransomware_notes_lookup ransomware_notes as file_name OUTPUT status as "Known Ransomware Notes" | search "Known Ransomware Notes"=True
+description = This macro limits the output to files that have been identified as a ransomware note
+
+[remove_valid_domains]
+definition = eval domain=trim(domain,"*") | search NOT[| inputlookup domains]  NOT[ |inputlookup cim_corporate_email_domain_lookup] NOT[inputlookup cim_corporate_web_domain_lookup] | eval domain="*"+domain+"*"
+description = This macro removes valid domains from the output
+
+[s3_accesslogs]
+definition = sourcetype=aws:s3:accesslogs
+description = customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch vpc logs. Replace the macro definition with configurations for your Splunk Environmnent.
+
+[security_content_ctime(1)]
+args = field
+definition = convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)
+description = convert epoch time to string
+
+[security_content_summariesonly]
+definition = summariesonly=false allow_old_summaries=true
+description = search data model's summaries only
+
+[security_group_api_calls]
+definition = (eventName=AuthorizeSecurityGroupIngress OR eventName=CreateSecurityGroup OR eventName=DeleteSecurityGroup OR eventName=DescribeClusterSecurityGroups OR eventName=DescribeDBSecurityGroups OR eventName=DescribeSecurityGroupReferences OR eventName=DescribeSecurityGroups OR eventName=DescribeStaleSecurityGroups OR eventName=RevokeSecurityGroupIngress OR eventName=UpdateSecurityGroupRuleDescriptionsIngress)
+description = This macro is a list of AWS event names associated with security groups
+
+[stream_dns]
+definition = sourcetype=stream:dns
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[stream_http]
+definition = sourcetype=stream:http
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[stream_tcp]
+definition = sourcetype=stream:tcp
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[suspicious_email_attachments]
+definition = lookup update=true is_suspicious_file_extension_lookup file_name OUTPUT suspicious | search suspicious=true
+description = This macro limits the output to email attachments that have suspicious extensions
+
+[suspicious_writes]
+definition = lookup suspicious_writes_lookup file as file_name OUTPUT note as "Reference" | search "Reference" != False
+description = This macro limites the output to file names that have been marked as suspicious
+
+[sysmon]
+definition = sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[system_network_configuration_discovery_tools]
+definition = (process_name= "arp.exe" OR process_name= "at.exe" OR process_name= "attrib.exe" OR process_name= "cscript.exe" OR process_name= "dsquery.exe" OR process_name= "hostname.exe" OR process_name= "ipconfig.exe" OR process_name= "mimikatz.exe" OR process_name= "nbstat.exe" OR process_name= "net.exe" OR process_name= "netsh.exe" OR process_name= "nslookup.exe" OR process_name= "ping.exe" OR process_name= "quser.exe" OR process_name= "qwinsta.exe" OR process_name= "reg.exe" OR process_name= "runas.exe" OR process_name= "sc.exe" OR process_name= "schtasks.exe" OR process_name= "ssh.exe" OR process_name= "systeminfo.exe" OR process_name= "taskkill.exe" OR process_name= "telnet.exe" OR process_name= "tracert.exe" OR process_name="wscript.exe" OR process_name= "xcopy.exe")
+description = This macro is a list of process that can be used to discover the network configuration
+
+[uncommon_processes]
+definition = lookup update=true lookup_uncommon_processes_default process_name as process_name outputnew uncommon_default,category_default,analytic_story_default,kill_chain_phase_default,mitre_attack_default | lookup update=true  lookup_uncommon_processes_local process_name as process_name outputnew uncommon_local,category_local,analytic_story_local,kill_chain_phase_local,mitre_attack_local | eval uncommon = coalesce(uncommon_default, uncommon_local), analytic_story = coalesce(analytic_story_default, analytic_story_local), category=coalesce(category_default, category_local), kill_chain_phase=coalesce(kill_chain_phase_default, kill_chain_phase_local), mitre_attack=coalesce(mitre_attack_default, mitre_attack_local) | fields - analytic_story_default, analytic_story_local, category_default, category_local, kill_chain_phase_default, kill_chain_phase_local, mitre_attack_default, mitre_attack_local, uncommon_default, uncommon_local | search uncommon=true
+description = This macro limits the output to processes that have been marked as uncommon
+
+[wineventlog_security]
+definition = eventtype=wineventlog_security
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[wineventlog_system]
+definition = eventtype=wineventlog_system
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[wmi]
+definition = sourcetype="wineventlog:microsoft-windows-wmi-activity/operational"
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[zeek_rpc]
+definition = index=zeek sourcetype="zeek:rpc:json"
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[zeek_ssl]
+definition = index=zeek sourcetype="zeek:ssl:json"
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
+[aws_ecr_container_scanning_findings_high_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_ecr_container_scanning_findings_low_informational_unknown_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_ecr_container_scanning_findings_medium_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_ecr_container_upload_outside_business_hours_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_ecr_container_upload_unknown_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_excessive_security_scanning_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gsuite_email_suspicious_attachment_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gsuite_drive_share_in_external_email_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gsuite_email_suspicious_subject_with_attachment_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gsuite_email_with_known_abuse_web_service_link_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gsuite_outbound_email_with_attachment_to_external_domain_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gsuite_suspicious_shared_file_name_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_nginx_ingress_lfi_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_nginx_ingress_rfi_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_scanner_image_pulling_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+

dist/devsecops/default/props.conf

@@ -0,0 +1,2 @@
+[stash]
+lookup_image_to_repository = images_to_repository image OUTPUT repository

dist/devsecops/default/savedsearches.conf

@@ -0,0 +1,749 @@
+#############
+# Automatically generated by generator.py in splunk/security_content
+# On Date: 2021-08-27T14:41:52 UTC
+# Author: Splunk Security Research
+# Contact: research@splunk.com
+#############
+
+### ESCU DETECTIONS ###
+
+[ESCU - AWS ECR Container Scanning Findings High - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
+action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
+action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+action.escu.known_false_positives = unknown
+action.escu.creation_date = 2021-08-17
+action.escu.modification_date = 2021-08-17
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - AWS ECR Container Scanning Findings High - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Dev Sec Ops"]
+action.risk = 1
+action.risk.param._risk_message = Vulnerabilities with severity high found in repository $repositoryName$
+action.risk.param._risk = [{"threat_object_field": "repositoryName", "threat_object_type": "system"}]
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - AWS ECR Container Scanning Findings High - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repositoryName", "role": ["Victim"], "type": "System"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
+action.notable.param.rule_title = AWS ECR Container Scanning Findings High
+action.notable.param.security_domain = network
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity=HIGH | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName | eval finding = finding_name.", ".finding_description | eval phase="release" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_high_filter` | collect index=findings
+
+[ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
+action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
+action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+action.escu.known_false_positives = unknown
+action.escu.creation_date = 2021-08-17
+action.escu.modification_date = 2021-08-17
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Dev Sec Ops"]
+action.risk = 1
+action.risk.param._risk_message = Vulnerabilities with severity high found in repository $repositoryName$
+action.risk.param._risk = [{"threat_object_field": "repositoryName", "threat_object_type": "system"}]
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repositoryName", "role": ["Victim"], "type": "System"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
+action.notable.param.rule_title = AWS ECR Container Scanning Findings Low Informational Unknown
+action.notable.param.security_domain = network
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity IN (LOW, INFORMATIONAL, UNKNWON) | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName | eval finding = finding_name.", ".finding_description | eval phase="release" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_low_informational_unknown_filter` | collect index=findings
+
+[ESCU - AWS ECR Container Scanning Findings Medium - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
+action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
+action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+action.escu.known_false_positives = unknown
+action.escu.creation_date = 2021-08-17
+action.escu.modification_date = 2021-08-17
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - AWS ECR Container Scanning Findings Medium - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Dev Sec Ops"]
+action.risk = 1
+action.risk.param._risk_message = Vulnerabilities with severity high found in repository $repositoryName$
+action.risk.param._risk = [{"threat_object_field": "repositoryName", "threat_object_type": "system"}]
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - AWS ECR Container Scanning Findings Medium - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repositoryName", "role": ["Victim"], "type": "System"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
+action.notable.param.rule_title = AWS ECR Container Scanning Findings Medium
+action.notable.param.security_domain = network
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity=MEDIUM | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName | eval finding = finding_name.", ".finding_description | eval phase="release" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_medium_filter` | collect index=findings
+
+[ESCU - AWS ECR Container Upload Outside Business Hours - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done during business hours. When done outside business hours, we want to take a look into it.
+action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done during business hours. When done outside business hours, we want to take a look into it.
+action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+action.escu.known_false_positives = When your development is spreaded in different time zones, applying this rule can be difficult.
+action.escu.creation_date = 2021-08-19
+action.escu.modification_date = 2021-08-19
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - AWS ECR Container Upload Outside Business Hours - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Dev Sec Ops"]
+action.risk = 1
+action.risk.param._risk_message = Container uploaded outside business hours from $user$
+action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - AWS ECR Container Upload Outside Business Hours - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Attacker"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done during business hours. When done outside business hours, we want to take a look into it.
+action.notable.param.rule_title = AWS ECR Container Upload Outside Business Hours
+action.notable.param.security_domain = network
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage date_hour>=20 OR date_hour<8 NOT (date_wday=saturday OR date_wday=sunday) | rename requestParameters.* as * | eval phase="release" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, user, userName, src_ip, imageTag, registryId, repositoryName, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_upload_outside_business_hours_filter` | collect index=findings
+
+[ESCU - AWS ECR Container Upload Unknown User - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done from only a few known users. When the user was never seen before, we should have a closer look into the event.
+action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done from only a few known users. When the user was never seen before, we should have a closer look into the event.
+action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+action.escu.known_false_positives = unknown
+action.escu.creation_date = 2021-08-19
+action.escu.modification_date = 2021-08-19
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - AWS ECR Container Upload Unknown User - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Dev Sec Ops"]
+action.risk = 1
+action.risk.param._risk_message = Container uploaded from unknown user $user$
+action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - AWS ECR Container Upload Unknown User - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Attacker"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done from only a few known users. When the user was never seen before, we should have a closer look into the event.
+action.notable.param.rule_title = AWS ECR Container Upload Unknown User
+action.notable.param.security_domain = network
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage NOT `aws_ecr_users` | rename requestParameters.* as * | eval phase="release" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, user, userName, src_ip, imageTag, registryId, repositoryName, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_upload_unknown_user_filter` | collect index=findings
+
+[ESCU - AWS Excessive Security Scanning - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment.
+action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment.
+action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+action.escu.known_false_positives = While this search has no known false positives.
+action.escu.creation_date = 2021-04-13
+action.escu.modification_date = 2021-04-13
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - AWS Excessive Security Scanning - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["AWS User Monitoring"]
+action.risk = 1
+action.risk.param._risk_message = user $user$ has excessive number of api calls $dc_events$ from these IP addresses $src$, violating the threshold of 50,  using the following commands $command$.
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18}]
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - AWS Excessive Security Scanning - Rule
+action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"], "cis20": ["CIS 13"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:Inbound", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Attacker"], "type": "User"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get*  | stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName values(src) as src values(userAgent) as userAgent by user userIdentity.arn | where dc_events > 50 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_excessive_security_scanning_filter` | collect index=findings
+
+[ESCU - GSuite Email Suspicious Attachment - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin.
+action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
+action.escu.data_models = []
+action.escu.eli5 = This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
+action.escu.known_false_positives = network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
+action.escu.creation_date = 2021-08-16
+action.escu.modification_date = 2021-08-16
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - GSuite Email Suspicious Attachment - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["DevSecOps"]
+action.risk = 1
+action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$
+action.risk.param._risk = [{"risk_object_field": "source.address", "risk_object_type": "user", "risk_score": 49}]
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - GSuite Email Suspicious Attachment - Rule
+action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "source.address", "role": ["attacker"], "type": "User"}, {"name": "destination{}.address", "role": ["Victim"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin.
+action.notable.param.rule_title = GSuite Email Suspicious Attachment
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb", "sh", "bat", "exe", "dll", "cpl", "com", "js", "vbs", "ps1", "reg","swf", "cmd", "go") | eval phase="plan" | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by destination{}.service num_message_attachments  subject destination{}.address source.address phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_email_suspicious_attachment_filter` | collect index=findings
+
+[ESCU - Gsuite Drive Share In External Email - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine.
+action.escu.mappings = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002"]}
+action.escu.data_models = []
+action.escu.eli5 = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
+action.escu.known_false_positives = network admin or normal user may share files to customer and external team.
+action.escu.creation_date = 2021-08-16
+action.escu.modification_date = 2021-08-16
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Gsuite Drive Share In External Email - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["DevSecOps"]
+action.risk = 1
+action.risk.param._risk_message = suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
+action.risk.param._risk = [{"risk_object_field": "parameters.owner", "risk_object_type": "user", "risk_score": 9}]
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Gsuite Drive Share In External Email - Rule
+action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002"], "observable": [{"name": "parameters.owner", "role": ["attacker"], "type": "User"}, {"name": "email", "role": ["Victim"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine.
+action.notable.param.rule_title = Gsuite Drive Share In External Email
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner "[^@]+@(?<src_domain>[^@]+)" | rex field=email "[^@]+@(?<dest_domain>[^@]+)" | where src_domain = "internal_test_email.com" and not dest_domain = "internal_test_email.com" | eval phase="plan" | stats values(parameters.doc_title) as doc_title, values(parameters.doc_type) as doc_types, values(email) as dst_email_list, values(parameters.visibility) as visibility, count min(_time) as firstTime max(_time) as lastTime by parameters.owner phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_drive_share_in_external_email_filter` | collect index=findings
+
+[ESCU - Gsuite Email Suspicious Subject With Attachment - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail.
+action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
+action.escu.data_models = []
+action.escu.eli5 = This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
+action.escu.known_false_positives = normal user or normal transaction may contain the subject and file type attachment that this detection try to search.
+action.escu.creation_date = 2021-08-19
+action.escu.modification_date = 2021-08-19
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Gsuite Email Suspicious Subject With Attachment - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["DevSecOps"]
+action.risk = 1
+action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$
+action.risk.param._risk = [{"risk_object_field": "source.address", "risk_object_type": "user", "risk_score": 25}]
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Gsuite Email Suspicious Subject With Attachment - Rule
+action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "source.address", "role": ["attacker"], "type": "User"}, {"name": "destination{}.address", "role": ["Victim"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail.
+action.notable.param.rule_title = Gsuite Email Suspicious Subject With Attachment
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `gsuite_gmail` num_message_attachments > 0 subject IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "* fedex *", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar", "html","htm","hta") | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" | eval phase="plan" | stats count min(_time) as firstTime max(_time) as lastTime values(attachment{}.file_extension_type) as email_attachments, values(attachment{}.sha256) as attachment_sha256, values(payload_size) as payload_size by destination{}.service num_message_attachments  subject destination{}.address source.address plan | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_email_suspicious_subject_with_attachment_filter` | collect index=findings
+
+[ESCU - Gsuite Email With Known Abuse Web Service Link - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services.
+action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
+action.escu.data_models = []
+action.escu.eli5 = This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
+action.escu.known_false_positives = normal email contains this link that are known application within the organization or network can be catched by this detection.
+action.escu.creation_date = 2021-08-23
+action.escu.modification_date = 2021-08-23
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Gsuite Email With Known Abuse Web Service Link - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["DevSecOps"]
+action.risk = 1
+action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$
+action.risk.param._risk = [{"risk_object_field": "source.address", "risk_object_type": "user", "risk_score": 25}]
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Gsuite Email With Known Abuse Web Service Link - Rule
+action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "source.address", "role": ["attacker"], "type": "User"}, {"name": "destination{}.address", "role": ["Victim"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services.
+action.notable.param.rule_title = Gsuite Email With Known Abuse Web Service Link
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" | eval phase="plan" |stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address subject destination{}.address phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_email_with_known_abuse_web_service_link_filter` | collect index=findings
+
+[ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment.
+action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003"]}
+action.escu.data_models = []
+action.escu.eli5 = This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
+action.escu.known_false_positives = network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
+action.escu.creation_date = 2021-08-17
+action.escu.modification_date = 2021-08-17
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["DevSecOps"]
+action.risk = 1
+action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$
+action.risk.param._risk = [{"risk_object_field": "source.address", "risk_object_type": "user", "risk_score": 9}]
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule
+action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003"], "observable": [{"name": "source.address", "role": ["attacker"], "type": "User"}, {"name": "destination{}.address", "role": ["Victim"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment.
+action.notable.param.rule_title = Gsuite Outbound Email With Attachment To External Domain
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `gsuite_gmail` num_message_attachments > 0 | rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)" | rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)" | where source_domain="internal_test_email.com" and not dest_domain="internal_test_email.com" | eval phase="plan" | stats values(subject) as subject, values(source.from_header_address) as src_domain_list, count as numEvents, dc(source.from_header_address) as numSrcAddresses, min(_time) as firstTime max(_time) as lastTime by dest_domain phase | where numSrcAddresses < 20 |sort - numSrcAddresses | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_outbound_email_with_attachment_to_external_domain_filter` | collect index=findings
+
+[ESCU - Gsuite Suspicious Shared File Name - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer.
+action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
+action.escu.data_models = []
+action.escu.eli5 = This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
+action.escu.known_false_positives = normal user or normal transaction may contain the subject and file type attachment that this detection try to search
+action.escu.creation_date = 2021-08-23
+action.escu.modification_date = 2021-08-23
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Gsuite Suspicious Shared File Name - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["DevSecOps"]
+action.risk = 1
+action.risk.param._risk_message = suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
+action.risk.param._risk = [{"risk_object_field": "parameters.owner", "risk_object_type": "user", "risk_score": 9}]
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Gsuite Suspicious Shared File Name - Rule
+action.correlationsearch.annotations = {"analytic_story": ["DevSecOps"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Reconnaissance"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "parameters.owner", "role": ["attacker"], "type": "User"}, {"name": "email", "role": ["Victim"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = ['user']
+action.notable.param.rule_description = This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer.
+action.notable.param.rule_title = Gsuite Suspicious Shared File Name
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation") | rex field=parameters.owner "[^@]+@(?<source_domain>[^@]+)" | rex field=parameters.target_user "[^@]+@(?<dest_domain>[^@]+)" | where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com" | eval phase="plan" | stats count min(_time) as firstTime max(_time) as lastTime by email parameters.owner parameters.target_user parameters.doc_title parameters.doc_type phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `gsuite_suspicious_shared_file_name_filter` | collect index=findings
+
+[ESCU - Kubernetes Nginx Ingress LFI - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search uses the Kubernetes logs from a nginx ingress controller to detect local file inclusion attacks.
+action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = This search uses the Kubernetes logs from a nginx ingress controller to detect local file inclusion attacks.
+action.escu.how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
+action.escu.known_false_positives = unknown
+action.escu.creation_date = 2021-08-20
+action.escu.modification_date = 2021-08-20
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Kubernetes Nginx Ingress LFI - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Dev Sec Ops"]
+action.risk = 1
+action.risk.param._risk_message = Local File Inclusion Attack detected on $host$
+action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Kubernetes Nginx Ingress LFI - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search uses the Kubernetes logs from a nginx ingress controller to detect local file inclusion attacks.
+action.notable.param.rule_title = Kubernetes Nginx Ingress LFI
+action.notable.param.security_domain = network
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `kubernetes_container_controller` | rex field=_raw "^(?<remote_addr>\S+)\s+-\s+-\s+\[(?<time_local>[^\]]*)\]\s\"(?<request>[^\"]*)\"\s(?<status>\S*)\s(?<body_bytes_sent>\S*)\s\"(?<http_referer>[^\"]*)\"\s\"(?<http_user_agent>[^\"]*)\"\s(?<request_length>\S*)\s(?<request_time>\S*)\s\[(?<proxy_upstream_name>[^\]]*)\]\s\[(?<proxy_alternative_upstream_name>[^\]]*)\]\s(?<upstream_addr>\S*)\s(?<upstream_response_length>\S*)\s(?<upstream_response_time>\S*)\s(?<upstream_status>\S*)\s(?<req_id>\S*)" | lookup local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT lfi_path | search lfi_path=yes | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | rex field=request "^(?<http_method>\S+)\s(?<url>\S+)\s" | eval phase="operate" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status, url, http_method, host, http_user_agent, proxy, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter` | collect index=findings
+
+[ESCU - Kubernetes Nginx Ingress RFI - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search uses the Kubernetes logs from a nginx ingress controller to detect remote file inclusion attacks.
+action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = This search uses the Kubernetes logs from a nginx ingress controller to detect remote file inclusion attacks.
+action.escu.how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
+action.escu.known_false_positives = unknown
+action.escu.creation_date = 2021-08-23
+action.escu.modification_date = 2021-08-23
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Kubernetes Nginx Ingress RFI - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Dev Sec Ops"]
+action.risk = 1
+action.risk.param._risk_message = Remote File Inclusion Attack detected on $host$
+action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Kubernetes Nginx Ingress RFI - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search uses the Kubernetes logs from a nginx ingress controller to detect remote file inclusion attacks.
+action.notable.param.rule_title = Kubernetes Nginx Ingress RFI
+action.notable.param.security_domain = network
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `kubernetes_container_controller` | rex field=_raw "^(?<remote_addr>\S+)\s+-\s+-\s+\[(?<time_local>[^\]]*)\]\s\"(?<request>[^\"]*)\"\s(?<status>\S*)\s(?<body_bytes_sent>\S*)\s\"(?<http_referer>[^\"]*)\"\s\"(?<http_user_agent>[^\"]*)\"\s(?<request_length>\S*)\s(?<request_time>\S*)\s\[(?<proxy_upstream_name>[^\]]*)\]\s\[(?<proxy_alternative_upstream_name>[^\]]*)\]\s(?<upstream_addr>\S*)\s(?<upstream_response_length>\S*)\s(?<upstream_response_time>\S*)\s(?<upstream_status>\S*)\s(?<req_id>\S*)" | rex field=request "^(?<http_method>\S+)?\s(?<url>\S+)\s" | rex field=url "(?<dest_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | search dest_ip=* | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | eval phase="operate" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, dest_ip status, url, http_method, host, http_user_agent, proxy, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_rfi_filter` | collect index=findings
+
+[ESCU - Kubernetes Scanner Image Pulling - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search uses the Kubernetes logs from Splunk Connect from Kubernetes to detect Kubernetes Security Scanner.
+action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = This search uses the Kubernetes logs from Splunk Connect from Kubernetes to detect Kubernetes Security Scanner.
+action.escu.how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
+action.escu.known_false_positives = unknown
+action.escu.creation_date = 2021-08-24
+action.escu.modification_date = 2021-08-24
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Kubernetes Scanner Image Pulling - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud", "Dev Sec Ops Analytics"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Dev Sec Ops"]
+action.risk = 1
+action.risk.param._risk_message = Kubernetes Scanner image pulled on host $host$
+action.risk.param._risk = [{"threat_object_field": "host", "threat_object_type": "entity"}]
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Kubernetes Scanner Image Pulling - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "host", "type": "Entity"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search uses the Kubernetes logs from Splunk Connect from Kubernetes to detect Kubernetes Security Scanner.
+action.notable.param.rule_title = Kubernetes Scanner Image Pulling
+action.notable.param.security_domain = network
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*") | rename object.* AS * | rename involvedObject.* AS * | rename source.host AS host | eval phase="operate" | stats min(_time) as firstTime max(_time) as lastTime count by host, name, namespace, kind, reason, message, phase | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_scanner_image_pulling_filter` | collect index=findings
+
+### END ESCU DETECTIONS ###
+
+
+### ESCU BASELINES ###
+
+
+
+### ESCU RESPONSE TASKS ###
+
+
+
+### END ESCU RESPONSE TASKS ###
+
+### USAGE DASHBOARD CONFIGURATIONS ###
+
+[escu-metrics-usage]
+action.email.useNSSubject = 1
+alert.digest_mode = True
+alert.suppress = 0
+alert.track = 0
+auto_summarize.dispatch.earliest_time = -1d@h
+dispatchAs = user
+search = index=_audit sourcetype="audittrail" \
+"ESCU - "\
+| stats count(search) by search savedsearch_name user\
+| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \
+| rex field=search "\"(?<savedsearch_name>.*)\""\
+| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=*
+
+[escu-metrics-search]
+action.email.useNSSubject = 1
+alert.suppress = 0
+alert.track = 0
+auto_summarize.dispatch.earliest_time = -1d@h
+enableSched = 1
+cron_schedule = 0 0 * * *
+dispatch.earliest_time = -4h@h
+dispatch.latest_time = -1h@h
+search = index=_audit action=search | transaction search_id maxspan=3m | search ESCU | stats sum(total_run_time) avg(total_run_time) max(total_run_time) sum(result_count)
+
+[escu-metrics-search-events]
+action.email.useNSSubject = 1
+alert.digest_mode = True
+alert.suppress = 0
+alert.track = 0
+auto_summarize.dispatch.earliest_time = -1d@h
+cron_schedule = 0 0 * * *
+enableSched = 1
+dispatch.earliest_time = -4h@h
+dispatch.latest_time = -1h@h
+search = [search index=_audit sourcetype="audittrail" \"ESCU NOT "index=_audit" | where search !="" | dedup search_id | rex field=search "\"(?<search_name>.*)\"" | rex field=_raw "user=(?<user>[a-zA-Z0-9_\-]+)" | eval usage=if(savedsearch_name!="", "scheduled", "adhoc") | eval savedsearch_name=if(savedsearch_name != "", savedsearch_name, search_name) | table savedsearch_name search_id user _time usage | outputlookup escu_search_id.csv | table search_id] index=_audit total_run_time event_count result_count NOT "index=_audit" | lookup escu_search_id.csv search_id | stats count(savedsearch_name) AS search_count avg(total_run_time) AS search_avg_run_time sum(total_run_time) AS search_total_run_time sum(result_count) AS search_total_results earliest(_time) AS firsts latest(_time) AS lasts by savedsearch_name user usage| eval first_run=strftime(firsts, "%B %d %Y") | eval last_run=strftime(lasts, "%B %d %Y")
+
+[escu-metrics-search-longest-runtime]
+action.email.useNSSubject = 1
+alert.digest_mode = True
+alert.suppress = 0
+alert.track = 0
+auto_summarize.dispatch.earliest_time = -1d@h
+enableSched = 1
+cron_schedule = 0 0 * * *
+disabled = 1
+dispatch.earliest_time = -4h@h
+dispatch.latest_time = -1h@h
+search = index=_* ESCU [search index=_* action=search latest=-2h earliest=-1d| transaction search_id maxspan=3m | search ESCU | stats values(total_run_time) AS run by search_id | sort -run | head 1| table search_id] | table search search_id
+
+[escu-metrics-usage-search]
+action.email.useNSSubject = 1
+alert.digest_mode = True
+alert.suppress = 0
+alert.track = 0
+auto_summarize.dispatch.earliest_time = -1d@h
+cron_schedule = 0 0 * * *
+dispatch.earliest_time = -4h@h
+dispatch.latest_time = -1h@h
+enableSched = 1
+dispatchAs = user
+search = index=_audit sourcetype="audittrail" \
+"ESCU - "\
+| stats count(search) by search savedsearch_name user\
+| eval usage=(if(savedsearch_name=="","Adhoc","Scheduled")) \
+| rex field=search "\"(?<savedsearch_name>.*)\""\
+| table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=*
+
+### END OF USAGE DASHBOARD CONFIGURATIONS ###

dist/devsecops/default/transforms.conf

@@ -0,0 +1,271 @@
+#############
+# Automatically generated by generator.py in splunk/security_content
+# On Date: 2021-08-27T14:41:52 UTC
+# Author: Splunk Security Research
+# Contact: research@splunk.com
+#############
+
+[api_call_by_user_baseline]
+collection = api_call_by_user_baseline
+external_type = kvstore
+# description = A collection that will contain the baseline information for number of AWS API calls per user
+fields_list = arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls
+
+[attacker_tools]
+filename = attacker_tools.csv
+default_match = false
+case_sensitive_match = false
+# description = A list of tools used by attackers
+match_type = WILDCARD(attacker_tool_names)
+min_matches = 1
+
+[aws_service_accounts]
+filename = aws_service_accounts.csv
+# description = A lookup file that will contain AWS Service accounts
+
+[baseline_blocked_outbound_connections]
+filename = baseline_blocked_outbound_connections.csv
+# description = A lookup file that will contain the baseline information for number of blocked outbound connections
+
+[brandMonitoring_lookup]
+filename = brand_monitoring.csv
+default_match = false
+# description = A file that contains look-a-like domains for brands that you want to monitor
+match_type = WILDCARD(domain)
+min_matches = 1
+
+[cloud_instances_enough_data]
+collection = cloud_instances_enough_data
+external_type = kvstore
+default_match = false
+# description = A lookup to determine if you have a sufficient amount of time has passed to collect cloud instance data for behavioral searches
+match_type = WILDCARD(filter)
+fields_list = _key, filter, enough_data
+
+[csc_lookup]
+filename = csc_lookup.csv
+# description = The CSC control numbers and names
+min_matches = 1
+
+[discovered_dns_records]
+filename = discovered_dns_records.csv
+default_match = false
+# description = A placeholder for a list of discovered DNS records generated by the baseline discover_dns_records
+min_matches = 1
+
+[domains]
+filename = domains.csv
+# description = A list of domains that can be ignored
+
+[dynamic_dns_providers_default]
+filename = dynamic_dns_providers_default.csv
+case_sensitive_match = false
+# description = A list of dynammic dns providers that should not be modified
+match_type = WILDCARD(dynamic_dns_domains)
+
+[dynamic_dns_providers_local]
+filename = dynamic_dns_providers_local.csv
+case_sensitive_match = false
+# description = A list of dynammic dns providers that can be modified
+match_type = WILDCARD(dynamic_dns_domains)
+
+[escu_search_id_lookup]
+filename = escu_search_id.csv
+# description = A placeholder lookup file to hold information for ESCU Usage dashboard
+
+[is_suspicious_file_extension_lookup]
+filename = is_suspicious_file_extension_lookup.csv
+# description = A list of suspicious extensions for email attachments
+match_type = WILDCARD(file_name)
+
+[is_windows_system_file]
+filename = is_windows_system_file.csv
+default_match = false
+# description = A full baseline of executable files in Windows\System32 and Windows\Syswow64, including sub-directories from Server 2016 and Windows 10.
+min_matches = 1
+
+[legit_domains]
+filename = legit_domains.csv
+# description = A list of legit domains to be used as an ignore list for possible phishing sites
+
+[local_file_inclusion_paths]
+filename = local_file_inclusion_paths.csv
+default_match = false
+case_sensitive_match = false
+# description = A list of interesting files in a local file inclusion attack
+match_type = WILDCARD(local_file_inclusion_paths)
+min_matches = 1
+
+[lookup_rare_process_allow_list_default]
+filename = rare_process_allow_list_default.csv
+default_match = false
+case_sensitive_match = false
+# description = A list of rare processes that are legitimate that is provided by Splunk
+match_type = WILDCARD(process)
+min_matches = 1
+
+[lookup_rare_process_allow_list_local]
+filename = rare_process_allow_list_local.csv
+default_match = false
+case_sensitive_match = false
+# description = A list of rare processes that are legitimate provided by the end user
+match_type = WILDCARD(process)
+min_matches = 1
+
+[lookup_uncommon_processes_default]
+filename = uncommon_processes_default.csv
+case_sensitive_match = false
+# description = A list of processes that are not common
+match_type = WILDCARD(process)
+
+[lookup_uncommon_processes_local]
+filename = uncommon_processes_local.csv
+case_sensitive_match = false
+# description = A list of processes that are not common
+match_type = WILDCARD(process)
+
+[network_acl_activity_baseline]
+filename = network_acl_activity_baseline.csv
+# description = A lookup file that will contain the baseline information for number of AWS Network ACL Activity
+
+[previously_seen_S3_access_from_remote_ip]
+filename = previously_seen_S3_access_from_remote_ip.csv
+# description = A placeholder for a list of IPs that have access S3
+
+[previously_seen_api_calls_from_user_roles]
+filename = previously_seen_api_calls_from_user_roles.csv
+# description = A placeholder for a list of AWS API calls for each user role
+
+[previously_seen_aws_cross_account_activity]
+filename = previously_seen_aws_cross_account_activity.csv
+# description = A placeholder for a list of AWS accounts and assumed roles
+
+[previously_seen_aws_regions]
+filename = previously_seen_aws_regions.csv
+default_match = false
+# description = A place holder for a list of used AWS regions
+min_matches = 1
+
+[previously_seen_cloud_api_calls_per_user_role]
+collection = previously_seen_cloud_api_calls_per_user_role
+external_type = kvstore
+# description = A table of users, commands, and the first and last time that they have been seen
+fields_list = _key, user, command, firstTimeSeen, lastTimeSeen, enough_data
+
+[previously_seen_cloud_compute_creations_by_user]
+collection = previously_seen_cloud_compute_creations_by_user
+external_type = kvstore
+# description = A table of previously seen users creating cloud instances
+fields_list = _key, firstTimeSeen, lastTimeSeen, user, enough_data
+
+[previously_seen_cloud_compute_images]
+collection = previously_seen_cloud_compute_images
+external_type = kvstore
+# description = A table of previously seen Cloud image IDs
+fields_list = _key, firstTimeSeen, lastTimeSeen, image_id, enough_data
+
+[previously_seen_cloud_compute_instance_types]
+collection = previously_seen_cloud_compute_instance_types
+external_type = kvstore
+# description = A place holder for a list of used cloud compute instance types
+fields_list = _key, firstTimeSeen, lastTimeSeen, instance_type, enough_data
+
+[previously_seen_cloud_instance_modifications_by_user]
+collection = previously_seen_cloud_instance_modifications_by_user
+external_type = kvstore
+# description = A table of users seen making instance modifications, and the first and last time that the activity was observed
+fields_list = _key, firstTimeSeen, lastTimeSeen, user, enough_data
+
+[previously_seen_cloud_provisioning_activity_sources]
+collection = previously_seen_cloud_provisioning_activity_sources
+external_type = kvstore
+# description = A table of source IPs, geographic locations, and the first and last time that they have that done cloud provisioning activities
+fields_list = _key, src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data
+
+[previously_seen_cloud_regions]
+collection = previously_seen_cloud_regions
+external_type = kvstore
+# description = A table of vendor_region values and the first and last time that they have been observed in cloud provisioning activities
+fields_list = _key, firstTimeSeen, lastTimeSeen, vendor_region, enough_data
+
+[previously_seen_cmd_line_arguments]
+filename = previously_seen_cmd_line_arguments.csv
+# description = A placeholder for a list of cmd line arugments that been seen before
+
+[previously_seen_ec2_modifications_by_user]
+filename = previously_seen_ec2_modifications_by_user.csv
+# description = A place holder for a list of AWS EC2 modifications done by each user
+
+[previously_seen_running_windows_services]
+collection = previously_seen_running_windows_services
+external_type = kvstore
+# description = A placeholder for the list of Windows Services running
+fields_list = _key, service, firstTimeSeen, lastTimeSeen
+
+[previously_seen_users_console_logins]
+collection = previously_seen_users_console_logins
+external_type = kvstore
+# description = A table of users seen doing console logins, and the first and last time that the activity was observed
+fields_list = _key, firstTime, lastTime, user, src, City, Region, Country
+
+[prohibited_apps_launching_cmd]
+filename = prohibited_apps_launching_cmd.csv
+# description = A list of processes that should not be launching cmd.exe
+match_type = WILDCARD(prohibited_applications)
+
+[prohibited_processes]
+filename = prohibited_processes.csv
+# description = A list of processes that have been marked as prohibited
+
+[prohibited_softwares]
+filename = prohibited_softwares.csv
+# description = A list of processes that have been marked as prohibited
+
+[ransomware_extensions_lookup]
+filename = ransomware_extensions.csv
+default_match = false
+case_sensitive_match = false
+# description = A list of file extensions that are associated with ransomware
+match_type = WILDCARD(Extensions)
+min_matches = 1
+
+[ransomware_notes_lookup]
+filename = ransomware_notes.csv
+default_match = false
+# description = A list of file names that are ransomware note files
+match_type = WILDCARD(ransomware_notes)
+min_matches = 1
+
+[s3_deletion_baseline]
+filename = s3_deletion_baseline.csv
+# description = A placeholder for the baseline information for AWS S3 deletions
+
+[security_group_activity_baseline]
+filename = security_group_activity_baseline.csv
+# description = A placeholder for the baseline information for AWS security groups
+
+[security_services_lookup]
+filename = security_services.csv
+default_match = false
+# description = A list of services that deal with security
+match_type = WILDCARD(service)
+min_matches = 1
+
+[suspicious_writes_lookup]
+filename = suspicious_files.csv
+default_match = false
+# description = A list of suspicious file names
+match_type = WILDCARD(file)
+min_matches = 1
+
+[zoom_first_time_child_process]
+collection = zoom_first_time_child_process
+external_type = kvstore
+# description = A list of suspicious file names
+fields_list = _key, dest, process_name, firstTimeSeen, lastTimeSeen
+
+
+### Default transforms definitions for the lookup files we ship ###
+[mitre_enrichment]
+filename = mitre_enrichment.csv
+# description = A lookup file that is created by generate.py

dist/devsecops/default/use_case_library.conf

@@ -0,0 +1,179 @@
+#############
+# Automatically generated by generator.py in splunk/security_content
+# On Date: 2021-08-27T14:41:52 UTC
+# Author: Splunk Security Research
+# Contact: research@splunk.com
+#############
+
+### STORIES ###
+
+[analytic_story://Dev Sec Ops]
+category = Cloud Security
+last_updated = 2021-08-18
+version = 1
+references = ["https://www.redhat.com/en/topics/devops/what-is-devsecops"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}]
+spec_version = 3
+searches = ["ESCU - AWS ECR Container Scanning Findings High - Rule", "ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule", "ESCU - AWS ECR Container Scanning Findings Medium - Rule", "ESCU - AWS ECR Container Upload Outside Business Hours - Rule", "ESCU - AWS ECR Container Upload Unknown User - Rule", "ESCU - Kubernetes Nginx Ingress LFI - Rule", "ESCU - Kubernetes Nginx Ingress RFI - Rule", "ESCU - Kubernetes Scanner Image Pulling - Rule"]
+description = This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor.
+narrative = DevSecOps is a collaborative framework, which thinks about application and infrastructure security from the start. This means that security tools are part of the continuous integration and continuous deployment pipeline. In this analytics story, we focused on detections around the tools used in this framework such as GitHub as a version control system, GDrive for the documentation, CircleCI as the CI/CD pipeline, Kubernetes as the container execution engine and multiple security tools such as Semgrep and Kube-Hunter.
+
+### END STORIES ###
+
+### DETECTIONS ###
+
+[savedsearch://ESCU - AWS ECR Container Scanning Findings High - Rule]
+type = detection
+asset_type = AWS Account
+confidence = medium
+explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
+how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+known_false_positives = unknown
+providing_technologies = []
+
+[savedsearch://ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule]
+type = detection
+asset_type = AWS Account
+confidence = medium
+explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
+how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+known_false_positives = unknown
+providing_technologies = []
+
+[savedsearch://ESCU - AWS ECR Container Scanning Findings Medium - Rule]
+type = detection
+asset_type = AWS Account
+confidence = medium
+explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results.
+how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+known_false_positives = unknown
+providing_technologies = []
+
+[savedsearch://ESCU - AWS ECR Container Upload Outside Business Hours - Rule]
+type = detection
+asset_type = AWS Account
+confidence = medium
+explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done during business hours. When done outside business hours, we want to take a look into it.
+how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+known_false_positives = When your development is spreaded in different time zones, applying this rule can be difficult.
+providing_technologies = []
+
+[savedsearch://ESCU - AWS ECR Container Upload Unknown User - Rule]
+type = detection
+asset_type = AWS Account
+confidence = medium
+explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done from only a few known users. When the user was never seen before, we should have a closer look into the event.
+how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+known_false_positives = unknown
+providing_technologies = []
+
+[savedsearch://ESCU - AWS Excessive Security Scanning - Rule]
+type = detection
+asset_type = AWS Account
+confidence = medium
+explanation = This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment.
+how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+known_false_positives = While this search has no known false positives.
+providing_technologies = []
+
+[savedsearch://ESCU - GSuite Email Suspicious Attachment - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This search is to detect a suspicious attachment file extension in Gsuite email that may related to spear phishing attack. This file type is commonly used by malware to lure user to click on it to execute malicious code to compromised targetted machine. But this search can also catch some normal files related to this file type that maybe send by employee or network admin.
+how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
+known_false_positives = network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
+providing_technologies = []
+
+[savedsearch://ESCU - Gsuite Drive Share In External Email - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This search is to detect suspicious google drive or google docs files shared outside or externally. This behavior might be a good hunting query to monitor exfitration of data made by an attacker or insider to a targetted machine.
+how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
+annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1567.002"]}
+known_false_positives = network admin or normal user may share files to customer and external team.
+providing_technologies = []
+
+[savedsearch://ESCU - Gsuite Email Suspicious Subject With Attachment - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This search is to detect a gsuite email contains suspicious subject having known file type used in spear phishing. This technique is a common and effective entry vector of attacker to compromise a network by luring the user to click or execute the suspicious attachment send from external email account because of the effective social engineering of subject related to delivery, bank and so on. On the other hand this detection may catch a normal email traffic related to legitimate transaction so better to check the email sender, spelling and etc. avoid click link or opening the attachment if you are not expecting this type of e-mail.
+how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
+known_false_positives = normal user or normal transaction may contain the subject and file type attachment that this detection try to search.
+providing_technologies = []
+
+[savedsearch://ESCU - Gsuite Email With Known Abuse Web Service Link - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This analytics is to detect a gmail containing a link that are known to be abused by malware or attacker like pastebin, telegram and discord to deliver malicious payload. This event can encounter some normal email traffic within organization and external email that normally using this application and services.
+how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
+known_false_positives = normal email contains this link that are known application within the organization or network can be catched by this detection.
+providing_technologies = []
+
+[savedsearch://ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This search is to detect a suspicious outbound e-mail from internal email to external email domain. This can be a good hunting query to monitor insider or outbound email traffic for not common domain e-mail. The idea is to parse the domain of destination email check if there is a minimum outbound traffic < 20 with attachment.
+how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003"]}
+known_false_positives = network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
+providing_technologies = []
+
+[savedsearch://ESCU - Gsuite Suspicious Shared File Name - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This search is to detect a shared file in google drive with suspicious file name that are commonly used by spear phishing campaign. This technique is very popular to lure the user by running a malicious document or click a malicious link within the shared file that will redirected to malicious website. This detection can also catch some normal email communication between organization and its external customer.
+how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]}
+known_false_positives = normal user or normal transaction may contain the subject and file type attachment that this detection try to search
+providing_technologies = []
+
+[savedsearch://ESCU - Kubernetes Nginx Ingress LFI - Rule]
+type = detection
+asset_type = Kubernetes
+confidence = medium
+explanation = This search uses the Kubernetes logs from a nginx ingress controller to detect local file inclusion attacks.
+how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+known_false_positives = unknown
+providing_technologies = []
+
+[savedsearch://ESCU - Kubernetes Nginx Ingress RFI - Rule]
+type = detection
+asset_type = Kubernetes
+confidence = medium
+explanation = This search uses the Kubernetes logs from a nginx ingress controller to detect remote file inclusion attacks.
+how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+known_false_positives = unknown
+providing_technologies = []
+
+[savedsearch://ESCU - Kubernetes Scanner Image Pulling - Rule]
+type = detection
+asset_type = Kubernetes
+confidence = medium
+explanation = This search uses the Kubernetes logs from Splunk Connect from Kubernetes to detect Kubernetes Security Scanner.
+how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+known_false_positives = unknown
+providing_technologies = []
+
+### END DETECTIONS ###
+
+### RESPONSE TASKS ###
+
+### END RESPONSE TASKS ###

dist/devsecops/default/workflow_actions.conf

@@ -0,0 +1 @@
+

dist/devsecops/lookups/attacker_tools.csv

@@ -0,0 +1,26 @@
+attacker_tool_names,description
+remcom.exe,This process is an open source replacement to psexec and is not typically seen in an enterprise environment.
+pwdump.exe,This process is associated with a tool used to dump password hashes on a Windows system.
+pwdump2.exe,This process is associated with a tool used to dump password hashes on a Windows system.
+nc.exe,This process is an open source tool used for network communications.
+wce.exe,This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
+cain.exe,This process is associated with a tool used to collect user credentials and execute attacks.
+nmap.exe,This process is an open source network mapping tool used to identify hosts and listening services on a network.
+kidlogger.exe,This process is associated with a tool used to collect keyboard input on a host.
+isass.exe,This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
+svch0st.exe,This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
+at.exe,This process is used to schedule other processes to run.  schtasks.exe should be used instead as it provides more flexibility.
+getmail.exe,This process is seen to be used by attackers to extract email files from host machines.
+ntdll.exe,This process was identified as malicious by DHS Alert TA18-074A.
+netpass.exe,This process was identified as malicious by DHS Alert TA18-201A and attackers use this tool to recover all network passwords stored on your system for the current logged-on user.
+WebBrowserPassView.exe,This process was identified as malicious by DHS Alert TA18-201A and is used by attackers as a password recovery tool that reveals the passwords stored in Web Browsers.
+OutlookAddressBookView.exe,This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook.
+mailpv.exe,This process was identified by DHS Alert TA18-201A and attackers use this tool is a password-recovery tool that reveals the passwords and other account details from various email clients.
+NLBrute.exe,A RDP brute force tool found in botnets for further expansion and and acquisition of targets. This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords.
+selfdel.exe,This executable was delivered in the SamSam Ransomware Campain and the attackers levereged this binary to delete its malicilous activities.
+masscan.exe,This executable was delivered in the XMRig Crypto Miner
+Massscan_GUI.exe,This executable was delivered in the XMRig Crypto Miner
+KPortScan3.exe,This executable was delivered in the XMRig Crypto Miner and is commonly used by attackers to scan the internet
+NLAChecker.exe,A scanner tool that checks for Windows hosts for Network Level Authentication. This tool allows attackers to detect Windows Servers with RDP without NLA enabled which facilitates the use of brute force non microsoft rdp tools or exploits
+ns.exe,A commonly used tool used by attackers to scan and map file shares
+SilverBullet.exe,Malware was discovered in our monitoring of honey pots that abuses this open source software for scanning and connecting to hosts.

dist/devsecops/lookups/aws_service_accounts.csv

@@ -0,0 +1 @@
+identity

dist/devsecops/lookups/baseline_blocked_outbound_connections.csv

@@ -0,0 +1 @@
+src_ip,numDataPoints,latestCount,avgBlockedConnections,stdevBlockedConnections

dist/devsecops/lookups/brand_monitoring.csv

@@ -0,0 +1 @@
+domain,domain_abuse

dist/devsecops/lookups/csc_lookup.csv

@@ -0,0 +1,21 @@
+number, name
+1, Inventory of Authorized and Unauthorized Devices
+2, Inventory of Authorized and Unauthorized Software
+3, Secure Configuration of End-User Devices
+4, Continuous Vulnerability Assessment & Remediation
+5, Controlled Use of Administrative Privileges
+6, Maintenance Monitoring and Analysis of Audit Logs
+7, Email & Web Browser Protections
+8, Malware Defense
+9, Limitation & Control of Network Ports-Protocols & Services
+10, Data Recovery Capability
+11, Secure Configuration of Network Devices
+12, Boundary Defense
+13, Data Protection
+14, Controlled Access Based on Need to Know
+15, Wireless Access Control
+16, Account Monitoring and Control
+17, Security Skills Assessment and Appropriate Training
+18, Application Software Security
+19, Incident Response and Management
+20, Penetration Tests and Red Team Exercises

dist/devsecops/lookups/discovered_dns_records.csv

@@ -0,0 +1 @@
+count,domain,type,query,answer

dist/devsecops/lookups/domains.csv

@@ -0,0 +1 @@
+domain,isValidDomain

dist/devsecops/lookups/dynamic_dns_providers_local.csv

@@ -0,0 +1 @@
+dynamic_dns_domains, isDynDNS_local

dist/devsecops/lookups/escu_search_id.csv

@@ -0,0 +1 @@
+savedsearch_name, search_id, user, _time, usage

dist/devsecops/lookups/is_suspicious_file_extension_lookup.csv

@@ -0,0 +1,52 @@
+file_name,suspicious
+*.avi.com,true
+*.avi.exe,true
+*.doc.com,true
+*.doc.exe,true
+*.docx.com,true
+*.docx.exe,true
+*.jpg.com,true
+*.jpg.exe,true
+*.jpeg.com,true
+*.jpeg.exe,true
+*.mpg.com,true
+*.mpg.exe,true
+*.mpg2.com,true
+*.mpg2.exe,true
+*.mpeg.com,true
+*.mpeg.exe,true
+*.pdf.com,true
+*.pdf.exe,true
+*.png.com,true
+*.png.exe,true
+*.ppt.com,true
+*.ppt.exe,true
+*.pptx.com,true
+*.pptx.exe,true
+*.swf.com,true
+*.swf.exe,true
+*.xls.com,true
+*.xls.exe,true
+*.xlsx.com,true
+*.xlsx.exe,true
+*.zip.com,true
+*.zip.exe,true
+*.bat,true
+*.chm,true
+*.com,true
+*.cmd,true
+*.cpl,true
+*.exe,true
+*.hlp,true
+*.hta,true
+*.jar,true
+*.js,true
+*.msi,true
+*.pif,true
+*.ps1,true
+*.rar,true
+*.reg,true
+*.scr,true
+*.vbe,true
+*.vbs,true
+*.wsf,true

dist/devsecops/lookups/is_windows_system_file.csv

@@ -0,0 +1,753 @@
+filename,systemFile
+acu.exe,true
+AgentService.exe,true
+aitstatic.exe,true
+alg.exe,true
+AppHostRegistrationVerifier.exe,true
+appidcertstorecheck.exe,true
+appidpolicyconverter.exe,true
+appidtel.exe,true
+ApplicationFrameHost.exe,true
+ApplySettingsTemplateCatalog.exe,true
+AppVClient.exe,true
+AppVDllSurrogate.exe,true
+AppVNice.exe,true
+AppVStreamingUX.exe,true
+ARP.EXE,true
+at.exe,true
+AtBroker.exe,true
+attrib.exe,true
+audiodg.exe,true
+auditpol.exe,true
+AuthHost.exe,true
+autochk.exe,true
+autoconv.exe,true
+autofmt.exe,true
+AxInstUI.exe,true
+backgroundTaskHost.exe,true
+BackgroundTransferHost.exe,true
+bcastdvr.exe,true
+bcdboot.exe,true
+bcdedit.exe,true
+BioIso.exe,true
+bitsadmin.exe,true
+bootcfg.exe,true
+bootim.exe,true
+bridgeunattend.exe,true
+browser_broker.exe,true
+bthudtask.exe,true
+ByteCodeGenerator.exe,true
+cacls.exe,true
+calc.exe,true
+CameraSettingsUIHost.exe,true
+CastSrv.exe,true
+CertEnrollCtrl.exe,true
+certreq.exe,true
+certutil.exe,true
+change.exe,true
+changepk.exe,true
+charmap.exe,true
+CheckNetIsolation.exe,true
+chglogon.exe,true
+chgport.exe,true
+chgusr.exe,true
+chkdsk.exe,true
+chkntfs.exe,true
+choice.exe,true
+cipher.exe,true
+cleanmgr.exe,true
+cliconfg.exe,true
+clip.exe,true
+ClipUp.exe,true
+CloudExperienceHostBroker.exe,true
+CloudNotifications.exe,true
+CloudStorageWizard.exe,true
+cmd.exe,true
+cmdkey.exe,true
+cmdl32.exe,true
+cmmon32.exe,true
+cmstp.exe,true
+cofire.exe,true
+colorcpl.exe,true
+comp.exe,true
+compact.exe,true
+CompatTelRunner.exe,true
+CompMgmtLauncher.exe,true
+ComputerDefaults.exe,true
+Configure-SMRemoting.exe,true
+conhost.exe,true
+consent.exe,true
+control.exe,true
+convert.exe,true
+CredentialUIBroker.exe,true
+credwiz.exe,true
+cscript.exe,true
+csrss.exe,true
+ctfmon.exe,true
+cttune.exe,true
+cttunesvr.exe,true
+dasHost.exe,true
+DataExchangeHost.exe,true
+DataSenseLiveTileTask.exe,true
+dccw.exe,true
+dcgpofix.exe,true
+dcomcnfg.exe,true
+dcpromo.exe,true
+ddodiag.exe,true
+Defrag.exe,true
+DeviceCensus.exe,true
+DeviceEject.exe,true
+DeviceEnroller.exe,true
+DevicePairingWizard.exe,true
+DeviceProperties.exe,true
+DFDWiz.exe,true
+dfrgui.exe,true
+dfsrdiag.exe,true
+dialer.exe,true
+DIMC.exe,true
+diskpart.exe,true
+diskperf.exe,true
+diskraid.exe,true
+diskshadow.exe,true
+DiskSnapshot.exe,true
+Dism.exe,true
+dispdiag.exe,true
+DisplaySwitch.exe,true
+djoin.exe,true
+dllhost.exe,true
+dllhst3g.exe,true
+dmcertinst.exe,true
+dmcfghost.exe,true
+DmNotificationBroker.exe,true
+DmOmaCpMo.exe,true
+dnscacheugc.exe,true
+doskey.exe,true
+dpapimig.exe,true
+DpiScaling.exe,true
+dpnsvr.exe,true
+driverquery.exe,true
+drvcfg.exe,true
+drvinst.exe,true
+DsmUserTask.exe,true
+dsregcmd.exe,true
+dstokenclean.exe,true
+dvdplay.exe,true
+dwm.exe,true
+DWWIN.EXE,true
+dxdiag.exe,true
+Dxpserver.exe,true
+Eap3Host.exe,true
+EaseOfAccessDialog.exe,true
+easinvoker.exe,true
+EasPoliciesBrokerHost.exe,true
+EDPCleanup.exe,true
+edpnotify.exe,true
+efsui.exe,true
+EhStorAuthn.exe,true
+embeddedapplauncher.exe,true
+EmbeddedAppLauncherConfig.exe,true
+escUnattend.exe,true
+esentutl.exe,true
+eudcedit.exe,true
+eventcreate.exe,true
+eventvwr.exe,true
+expand.exe,true
+extrac32.exe,true
+fc.exe,true
+find.exe,true
+findstr.exe,true
+finger.exe,true
+fixmapi.exe,true
+fltMC.exe,true
+fodhelper.exe,true
+Fondue.exe,true
+fontdrvhost.exe,true
+fontview.exe,true
+forfiles.exe,true
+fsavailux.exe,true
+fsquirt.exe,true
+fsutil.exe,true
+ftp.exe,true
+GameBarPresenceWriter.exe,true
+GamePanel.exe,true
+GenValObj.exe,true
+getmac.exe,true
+gpresult.exe,true
+gpscript.exe,true
+gpupdate.exe,true
+grpconv.exe,true
+hdwwiz.exe,true
+help.exe,true
+HOSTNAME.EXE,true
+hvax64.exe,true
+hvix64.exe,true
+hvloader.exe,true
+hwrcomp.exe,true
+hwrreg.exe,true
+iashost.exe,true
+icacls.exe,true
+IcsEntitlementHost.exe,true
+icsunattend.exe,true
+ie4uinit.exe,true
+ieUnatt.exe,true
+iexpress.exe,true
+immersivetpmvscmgrsvr.exe,true
+InfDefaultInstall.exe,true
+InstallAgent.exe,true
+InstallAgentUserBroker.exe,true
+ipconfig.exe,true
+iscsicli.exe,true
+iscsicpl.exe,true
+isoburn.exe,true
+klist.exe,true
+ksetup.exe,true
+ktmutil.exe,true
+ktpass.exe,true
+label.exe,true
+LanguageComponentsInstallerComHandler.exe,true
+LaunchTM.exe,true
+LaunchWinApp.exe,true
+LbfoAdmin.exe,true
+LegacyNetUXHost.exe,true
+LicenseManagerShellext.exe,true
+licensingdiag.exe,true
+LicensingUI.exe,true
+LocationNotificationWindows.exe,true
+Locator.exe,true
+LockAppHost.exe,true
+LockScreenContentServer.exe,true
+lodctr.exe,true
+logagent.exe,true
+logman.exe,true
+logoff.exe,true
+LogonUI.exe,true
+lpkinstall.exe,true
+lpksetup.exe,true
+lpremove.exe,true
+LsaIso.exe,true
+lsass.exe,true
+Magnify.exe,true
+makecab.exe,true
+mavinject.exe,true
+MbaeParserTask.exe,true
+mblctr.exe,true
+mcbuilder.exe,true
+MDEServer.exe,true
+MDMAgent.exe,true
+MDMAppInstaller.exe,true
+MdmDiagnosticsTool.exe,true
+MdRes.exe,true
+MdSched.exe,true
+mfpmp.exe,true
+Microsoft.Uev.CscUnpinTool.exe,true
+Microsoft.Uev.SyncController.exe,true
+mmc.exe,true
+mobsync.exe,true
+mountvol.exe,true
+mpnotify.exe,true
+MpSigStub.exe,true
+MRINFO.EXE,true
+MRT-KB890830.exe,true
+MRT.exe,true
+MSchedExe.exe,true
+msconfig.exe,true
+msdt.exe,true
+msdtc.exe,true
+msfeedssync.exe,true
+msg.exe,true
+mshta.exe,true
+msiexec.exe,true
+msinfo32.exe,true
+mspaint.exe,true
+MsSpellCheckingHost.exe,true
+mstsc.exe,true
+mtstocom.exe,true
+MuiUnattend.exe,true
+MultiDigiMon.exe,true
+MusNotification.exe,true
+MusNotificationUx.exe,true
+Narrator.exe,true
+nbtstat.exe,true
+ndadmin.exe,true
+net.exe,true
+net1.exe,true
+netbtugc.exe,true
+netcfg.exe,true
+NetCfgNotifyObjectHost.exe,true
+netdom.exe,true
+NetEvtFwdr.exe,true
+NetHost.exe,true
+netiougc.exe,true
+Netplwiz.exe,true
+netsh.exe,true
+NETSTAT.EXE,true
+newdev.exe,true
+nltest.exe,true
+notepad.exe,true
+nslookup.exe,true
+ntoskrnl.exe,true
+ntprint.exe,true
+odbcad32.exe,true
+odbcconf.exe,true
+omadmclient.exe,true
+omadmprc.exe,true
+openfiles.exe,true
+OpenWith.exe,true
+OptionalFeatures.exe,true
+osk.exe,true
+PackagedCWALauncher.exe,true
+PackageInspector.exe,true
+PasswordOnWakeSettingFlyout.exe,true
+PATHPING.EXE,true
+pcalua.exe,true
+pcaui.exe,true
+pcwrun.exe,true
+perfmon.exe,true
+phoneactivate.exe,true
+PickerHost.exe,true
+PING.EXE,true
+PkgMgr.exe,true
+plasrv.exe,true
+PnPUnattend.exe,true
+pnputil.exe,true
+poqexec.exe,true
+powercfg.exe,true
+PresentationHost.exe,true
+PresentationSettings.exe,true
+prevhost.exe,true
+print.exe,true
+PrintBrmUi.exe,true
+PrintDialogHost.exe,true
+PrintDialogHost3D.exe,true
+printfilterpipelinesvc.exe,true
+PrintIsolationHost.exe,true
+printui.exe,true
+proquota.exe,true
+psr.exe,true
+pwlauncher.exe,true
+qappsrv.exe,true
+qprocess.exe,true
+query.exe,true
+quser.exe,true
+qwinsta.exe,true
+rasdial.exe,true
+rdpclip.exe,true
+rdpinit.exe,true
+rdpinput.exe,true
+RdpSa.exe,true
+RdpSaProxy.exe,true
+RdpSaUacHelper.exe,true
+rdpshell.exe,true
+rdpsign.exe,true
+rdrleakdiag.exe,true
+RDSPnf.exe,true
+ReAgentc.exe,true
+recover.exe,true
+RecoveryDrive.exe,true
+reg.exe,true
+regedt32.exe,true
+regini.exe,true
+Register-CimProvider.exe,true
+regsvr32.exe,true
+rekeywiz.exe,true
+relog.exe,true
+RelPost.exe,true
+RemotePosWorker.exe,true
+replace.exe,true
+reset.exe,true
+ResetEngine.exe,true
+resmon.exe,true
+RMActivate.exe,true
+RMActivate_isv.exe,true
+RMActivate_ssp.exe,true
+RMActivate_ssp_isv.exe,true
+RmClient.exe,true
+rmttpmvscmgrsvr.exe,true
+Robocopy.exe,true
+ROUTE.EXE,true
+RpcPing.exe,true
+rrinstaller.exe,true
+rsopprov.exe,true
+runas.exe,true
+rundll32.exe,true
+RunLegacyCPLElevated.exe,true
+runonce.exe,true
+RuntimeBroker.exe,true
+rwinsta.exe,true
+sacsess.exe,true
+sc.exe,true
+schtasks.exe,true
+ScriptRunner.exe,true
+sdbinst.exe,true
+sdiagnhost.exe,true
+SearchFilterHost.exe,true
+SearchIndexer.exe,true
+SearchProtocolHost.exe,true
+SecEdit.exe,true
+secinit.exe,true
+securekernel.exe,true
+SensorDataService.exe,true
+ServerManager.exe,true
+ServerManagerLauncher.exe,true
+services.exe,true
+sessionmsg.exe,true
+sethc.exe,true
+setres.exe,true
+setspn.exe,true
+SettingSyncHost.exe,true
+setupcl.exe,true
+setupugc.exe,true
+setx.exe,true
+sfc.exe,true
+shrpubw.exe,true
+shutdown.exe,true
+sigverif.exe,true
+SIHClient.exe,true
+sihost.exe,true
+SlideToShutDown.exe,true
+slui.exe,true
+smartscreen.exe,true
+SmartScreenSettings.exe,true
+smss.exe,true
+SndVol.exe,true
+SnippingTool.exe,true
+snmptrap.exe,true
+sort.exe,true
+SpaceAgent.exe,true
+spaceman.exe,true
+spoolsv.exe,true
+SppExtComObj.Exe,true
+sppsvc.exe,true
+stordiag.exe,true
+subst.exe,true
+svchost.exe,true
+sxstrace.exe,true
+SyncAppvPublishingServer.exe,true
+SyncHost.exe,true
+syskey.exe,true
+SysResetErr.exe,true
+systeminfo.exe,true
+SystemPropertiesAdvanced.exe,true
+SystemPropertiesComputerName.exe,true
+SystemPropertiesDataExecutionPrevention.exe,true
+SystemPropertiesHardware.exe,true
+SystemPropertiesPerformance.exe,true
+SystemPropertiesProtection.exe,true
+SystemPropertiesRemote.exe,true
+systemreset.exe,true
+SystemSettingsAdminFlows.exe,true
+SystemSettingsBroker.exe,true
+SystemSettingsRemoveDevice.exe,true
+systray.exe,true
+tabcal.exe,true
+takeown.exe,true
+TapiUnattend.exe,true
+taskhostw.exe,true
+taskkill.exe,true
+tasklist.exe,true
+Taskmgr.exe,true
+tcmsetup.exe,true
+TCPSVCS.EXE,true
+tdlrecover.exe,true
+ThumbnailExtractionHost.exe,true
+TieringEngineService.exe,true
+timeout.exe,true
+TokenBrokerCookies.exe,true
+TpmInit.exe,true
+tpmvscmgr.exe,true
+tpmvscmgrsvr.exe,true
+tracerpt.exe,true
+TRACERT.EXE,true
+tscon.exe,true
+tsdiscon.exe,true
+tsecimp.exe,true
+tskill.exe,true
+TSTheme.exe,true
+TSWbPrxy.exe,true
+typeperf.exe,true
+tzsync.exe,true
+tzutil.exe,true
+ucsvc.exe,true
+UevAgentPolicyGenerator.exe,true
+UevAppMonitor.exe,true
+UevTemplateBaselineGenerator.exe,true
+UevTemplateConfigItemGenerator.exe,true
+UI0Detect.exe,true
+unlodctr.exe,true
+unregmp2.exe,true
+UpgradeResultsUI.exe,true
+upnpcont.exe,true
+UserAccountBroker.exe,true
+UserAccountControlSettings.exe,true
+userinit.exe,true
+UsoClient.exe,true
+Utilman.exe,true
+VaultCmd.exe,true
+vds.exe,true
+vdsldr.exe,true
+verclsid.exe,true
+verifier.exe,true
+verifiergui.exe,true
+vssadmin.exe,true
+VSSUIRUN.exe,true
+VSSVC.exe,true
+w32tm.exe,true
+waitfor.exe,true
+WallpaperHost.exe,true
+WebCache.exe,true
+wecutil.exe,true
+WerFault.exe,true
+WerFaultSecure.exe,true
+wermgr.exe,true
+wevtutil.exe,true
+wextract.exe,true
+where.exe,true
+whoami.exe,true
+wiaacmgr.exe,true
+wiawow64.exe,true
+wimserv.exe,true
+win32calc.exe,true
+WinBioDataModelOOBE.exe,true
+Windows.Media.BackgroundPlayback.exe,true
+WindowsActionDialog.exe,true
+WindowsUpdateElevatedInstaller.exe,true
+wininit.exe,true
+winload.exe,true
+winlogon.exe,true
+winresume.exe,true
+winrs.exe,true
+winrshost.exe,true
+WinSAT.exe,true
+winver.exe,true
+wkspbroker.exe,true
+wksprt.exe,true
+wlrmdr.exe,true
+WMPDMC.exe,true
+wowreg32.exe,true
+WPDShextAutoplay.exe,true
+wpr.exe,true
+write.exe,true
+WSCollect.exe,true
+wscript.exe,true
+WSManHTTPConfig.exe,true
+wsmprovhost.exe,true
+wsqmcons.exe,true
+WSReset.exe,true
+wuapihost.exe,true
+wuauclt.exe,true
+WUDFHost.exe,true
+wusa.exe,true
+WWAHost.exe,true
+XblGameSaveTask.exe,true
+xcopy.exe,true
+xwizard.exe,true
+comrepl.exe,true
+MigRegDB.exe,true
+DiagnosticsHub.StandardCollector.Service.exe,true
+DismHost.exe,true
+F12Chooser.exe,true
+IMJPDCT.EXE,true
+IMJPSET.EXE,true
+IMJPUEX.EXE,true
+imjpuexc.exe,true
+IMTCLNWZ.EXE,true
+IMTCPROP.exe,true
+IMCCPHR.exe,true
+ImeBroker.exe,true
+imecfmui.exe,true
+IMEDICTUPDATEUI.EXE,true
+IMEPADSV.EXE,true
+IMESEARCH.EXE,true
+IMEWDBLD.EXE,true
+ChsIME.exe,true
+ChtIME.exe,true
+mighost.exe,true
+audit.exe,true
+AuditShD.exe,true
+FirstLogonAnim.exe,true
+msoobe.exe,true
+oobeldr.exe,true
+Setup.exe,true
+UserOOBEBroker.exe,true
+windeploy.exe,true
+SpeechUXWiz.exe,true
+SpeechModelDownload.exe,true
+SpeechRuntime.exe,true
+PrintBrm.exe,true
+PrintBrmEngine.exe,true
+sysprep.exe,true
+SystemResetPlatform.exe,true
+mofcomp.exe,true
+scrcons.exe,true
+unsecapp.exe,true
+wbemtest.exe,true
+WinMgmt.exe,true
+WMIADAP.exe,true
+WmiApSrv.exe,true
+WMIC.exe,true
+WmiPrvSE.exe,true
+powershell.exe,true
+powershell_ise.exe,true
+dplaysvr.exe,true
+dtdump.exe,true
+hh.exe,true
+instnm.exe,true
+perfhost.exe,true
+rasautou.exe,true
+rasphone.exe,true
+regedit.exe,true
+setup16.exe,true
+user.exe,true
+_isdel.exe,true
+agentactivationruntimestarter.exe,true
+ApplyTrustOffline.exe,true
+ApproveChildRequest.exe,true
+appverif.exe,true
+baaupdate.exe,true
+bash.exe,true
+bdechangepin.exe,true
+BdeHdCfg.exe,true
+BdeUISrv.exe,true
+bdeunlock.exe,true
+BitLockerDeviceEncryption.exe,true
+BitLockerWizard.exe,true
+BitLockerWizardElev.exe,true
+bootsect.exe,true
+browserexport.exe,true
+CIDiag.exe,true
+CompPkgSrv.exe,true
+convertvhd.exe,true
+coredpussvr.exe,true
+CredentialEnrollmentManager.exe,true
+curl.exe,true
+CustomInstallExec.exe,true
+d3dconfig.exe,true
+DataStoreCacheDumpTool.exe,true
+DataUsageLiveTileTask.exe,true
+deploymentcsphelper.exe,true
+desktopimgdownldr.exe,true
+DeviceCredentialDeployment.exe,true
+directxdatabaseupdater.exe,true
+dmclient.exe,true
+DTUHandler.exe,true
+dusmtask.exe,true
+DXCap.exe,true
+DXCpl.exe,true
+dxgiadaptercache.exe,true
+EASPolicyManagerBrokerHost.exe,true
+EduPrintProv.exe,true
+EoAExperiences.exe,true
+fhmanagew.exe,true
+FileHistory.exe,true
+FsIso.exe,true
+fvenotify.exe,true
+fveprompt.exe,true
+FXSCOVER.exe,true
+FXSSVC.exe,true
+FXSUNATD.exe,true
+hcsdiag.exe,true
+hnsdiag.exe,true
+hvsievaluator.exe,true
+ie4ushowIE.exe,true
+IESettingSync.exe,true
+InputSwitchToastHandler.exe,true
+iotstartup.exe,true
+manage-bde.exe,true
+MBR2GPT.EXE,true
+microsoft.windows.softwarelogo.showdesktop.exe,true
+MicrosoftEdgeBCHost.exe,true
+MicrosoftEdgeCP.exe,true
+MicrosoftEdgeDevTools.exe,true
+MicrosoftEdgeSH.exe,true
+mmgaserver.exe,true
+MoUsoCoreWorker.exe,true
+msra.exe,true
+MusNotifyIcon.exe,true
+NDKPing.exe,true
+NgcIso.exe,true
+nmbind.exe,true
+nmscrub.exe,true
+nvspinfo.exe,true
+ofdeploy.exe,true
+pacjsworker.exe,true
+PinEnrollmentBroker.exe,true
+PktMon.exe,true
+pospaymentsworker.exe,true
+provlaunch.exe,true
+provtool.exe,true
+ProximityUxHost.exe,true
+prproc.exe,true
+quickassist.exe,true
+raserver.exe,true
+RDVGHelper.exe,true
+recdisc.exe,true
+refsutil.exe,true
+RemoteAppLifetimeManager.exe,true
+RemoteFXvGPUDisablement.exe,true
+repair-bde.exe,true
+rstrui.exe,true
+runexehelper.exe,true
+sdchange.exe,true
+sdclt.exe,true
+SecurityHealthHost.exe,true
+SecurityHealthService.exe,true
+SecurityHealthSystray.exe,true
+SgrmBroker.exe,true
+SgrmLpac.exe,true
+SpatialAudioLicenseSrv.exe,true
+Spectrum.exe,true
+srdelayed.exe,true
+SrTasks.exe,true
+SystemUWPLauncher.exe,true
+tar.exe,true
+tcblaunch.exe,true
+TpmTool.exe,true
+ttdinject.exe,true
+tttracer.exe,true
+UIMgrBroker.exe,true
+upfc.exe,true
+usocoreworker.exe,true
+UtcDecoderHost.exe,true
+VBoxControl.exe,true
+VBoxService.exe,true
+VBoxTray.exe,true
+vfpctrl.exe,true
+vmcompute.exe,true
+vmwp.exe,true
+VsGraphicsDesktopEngine.exe,true
+VsGraphicsRemoteEngine.exe,true
+vsjitdebugger.exe,true
+WaaSMedicAgent.exe,true
+wbadmin.exe,true
+wbengine.exe,true
+WFS.exe,true
+wifitask.exe,true
+Windows.WARP.JITService.exe,true
+WinRTNetMUAHostServer.exe,true
+wlanext.exe,true
+WorkFolders.exe,true
+WpcMon.exe,true
+WpcTok.exe,true
+wpnpinst.exe,true
+wscadminui.exe,true
+wsl.exe,true
+wslconfig.exe,true
+WUDFCompanionHost.exe,true
+IEChooser.exe,true
+wslhost.exe,true
+scp.exe,true
+sftp.exe,true
+ssh-add.exe,true
+ssh-agent.exe,true
+ssh-keygen.exe,true
+ssh-keyscan.exe,true
+ssh.exe,true
+PerceptionSimulationInput.exe,true
+PerceptionSimulationService.exe,true
+UNPUXHost.exe,true
+UNPUXLauncher.exe,true
+UpdateNotificationMgr.exe,true
+FaceFodUninstaller.exe,true
+wlms.exe,true
+OneDriveSetup.exe,true
+OposHost.exe,true

dist/devsecops/lookups/legit_domains.csv

@@ -0,0 +1,20 @@
+domain, isLegit
+amazon.com, True
+ssl-images-amazon.com, True
+facebook.com, True
+xx.fbcdn.net, True
+github.com, True
+githubassets.com, True
+instagram.com, True
+linkedin.com, True
+microsoftonline.com, True
+office.com, True
+okta.com, True
+live.com, True
+protonmail.com, True
+reddit.com, True
+redditstatic.com, True
+twitter.com, True
+twimg.com, True
+google.com, True
+

dist/devsecops/lookups/mitre_enrichment.csv

@@ -0,0 +1,564 @@
+"mitre_id","technique","tactics","groups"
+"T1553.006","Code Signing Policy Modification","Defense Evasion","Turla|APT39"
+"T1614","System Location Discovery","Discovery","no"
+"T1613","Container and Resource Discovery","Discovery","no"
+"T1552.007","Container API","Credential Access","no"
+"T1612","Build Image on Host","Defense Evasion","no"
+"T1611","Escape to Host","Privilege Escalation","no"
+"T1204.003","Malicious Image","Execution","no"
+"T1053.007","Container Orchestration Job","Execution|Persistence|Privilege Escalation","no"
+"T1610","Deploy Container","Defense Evasion|Execution","no"
+"T1609","Container Administration Command","Execution","no"
+"T1608.005","Link Target","Resource Development","Silent Librarian"
+"T1608.004","Drive-by Target","Resource Development","APT32|Threat Group-3390"
+"T1608.003","Install Digital Certificate","Resource Development","no"
+"T1608.002","Upload Tool","Resource Development","Threat Group-3390"
+"T1608.001","Upload Malware","Resource Development","APT32"
+"T1608","Stage Capabilities","Resource Development","no"
+"T1016.001","Internet Connection Discovery","Discovery","APT29|UNC2452|Turla"
+"T1553.005","Mark-of-the-Web Bypass","Defense Evasion","TA505"
+"T1555.005","Password Managers","Credential Access","Fox Kitten|Operation Wocao"
+"T1484.002","Domain Trust Modification","Defense Evasion|Privilege Escalation","APT29|UNC2452"
+"T1484.001","Group Policy Modification","Defense Evasion|Privilege Escalation","Indrik Spider"
+"T1547.014","Active Setup","Persistence|Privilege Escalation","no"
+"T1606.002","SAML Tokens","Credential Access","APT29|UNC2452"
+"T1606.001","Web Cookies","Credential Access","APT29|UNC2452"
+"T1606","Forge Web Credentials","Credential Access","no"
+"T1555.004","Windows Credential Manager","Credential Access","Stealth Falcon|OilRig|Turla"
+"T1059.008","Network Device CLI","Execution","no"
+"T1602.002","Network Device Configuration Dump","Collection","no"
+"T1542.005","TFTP Boot","Defense Evasion|Persistence","no"
+"T1542.004","ROMMONkit","Defense Evasion|Persistence","no"
+"T1602.001","SNMP (MIB Dump)","Collection","no"
+"T1602","Data from Configuration Repository","Collection","no"
+"T1601.002","Downgrade System Image","Defense Evasion","no"
+"T1601.001","Patch System Image","Defense Evasion","no"
+"T1601","Modify System Image","Defense Evasion","no"
+"T1600.002","Disable Crypto Hardware","Defense Evasion","no"
+"T1600.001","Reduce Key Space","Defense Evasion","no"
+"T1600","Weaken Encryption","Defense Evasion","no"
+"T1556.004","Network Device Authentication","Credential Access|Defense Evasion|Persistence","no"
+"T1599.001","Network Address Translation Traversal","Defense Evasion","no"
+"T1599","Network Boundary Bridging","Defense Evasion","no"
+"T1020.001","Traffic Duplication","Exfiltration","no"
+"T1557.002","ARP Cache Poisoning","Credential Access|Collection","Cleaver"
+"T1588.006","Vulnerabilities","Resource Development","Sandworm Team"
+"T1053.006","Systemd Timers","Execution|Persistence|Privilege Escalation","no"
+"T1562.008","Disable Cloud Logs","Defense Evasion","no"
+"T1547.012","Print Processors","Persistence|Privilege Escalation","no"
+"T1598.003","Spearphishing Link","Reconnaissance","Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky"
+"T1598.002","Spearphishing Attachment","Reconnaissance","Sidewinder"
+"T1598.001","Spearphishing Service","Reconnaissance","no"
+"T1598","Phishing for Information","Reconnaissance","ZIRCONIUM|APT28"
+"T1597.002","Purchase Technical Data","Reconnaissance","no"
+"T1597.001","Threat Intel Vendors","Reconnaissance","no"
+"T1597","Search Closed Sources","Reconnaissance","no"
+"T1596.005","Scan Databases","Reconnaissance","no"
+"T1596.004","CDNs","Reconnaissance","no"
+"T1596.003","Digital Certificates","Reconnaissance","no"
+"T1596.001","DNS/Passive DNS","Reconnaissance","no"
+"T1596.002","WHOIS","Reconnaissance","no"
+"T1596","Search Open Technical Databases","Reconnaissance","no"
+"T1595.002","Vulnerability Scanning","Reconnaissance","Volatile Cedar|APT28|Sandworm Team"
+"T1595.001","Scanning IP Blocks","Reconnaissance","no"
+"T1595","Active Scanning","Reconnaissance","no"
+"T1594","Search Victim-Owned Websites","Reconnaissance","Silent Librarian|Sandworm Team"
+"T1593.002","Search Engines","Reconnaissance","no"
+"T1593.001","Social Media","Reconnaissance","no"
+"T1593","Search Open Websites/Domains","Reconnaissance","Sandworm Team"
+"T1592.004","Client Configurations","Reconnaissance","HAFNIUM"
+"T1592.003","Firmware","Reconnaissance","no"
+"T1592.002","Software","Reconnaissance","Sandworm Team"
+"T1592.001","Hardware","Reconnaissance","no"
+"T1592","Gather Victim Host Information","Reconnaissance","no"
+"T1591.004","Identify Roles","Reconnaissance","no"
+"T1591.003","Identify Business Tempo","Reconnaissance","no"
+"T1591.001","Determine Physical Locations","Reconnaissance","no"
+"T1591.002","Business Relationships","Reconnaissance","Sandworm Team"
+"T1591","Gather Victim Org Information","Reconnaissance","no"
+"T1590.006","Network Security Appliances","Reconnaissance","no"
+"T1590.005","IP Addresses","Reconnaissance","HAFNIUM"
+"T1590.004","Network Topology","Reconnaissance","no"
+"T1590.003","Network Trust Dependencies","Reconnaissance","no"
+"T1590.002","DNS","Reconnaissance","no"
+"T1590.001","Domain Properties","Reconnaissance","Sandworm Team"
+"T1590","Gather Victim Network Information","Reconnaissance","HAFNIUM"
+"T1589.003","Employee Names","Reconnaissance","Silent Librarian|Sandworm Team"
+"T1589.002","Email Addresses","Reconnaissance","TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team"
+"T1589.001","Credentials","Reconnaissance","APT28|Magic Hound|Chimera"
+"T1589","Gather Victim Identity Information","Reconnaissance","APT32"
+"T1588.005","Exploits","Resource Development","no"
+"T1588.004","Digital Certificates","Resource Development","Lazarus Group|Silent Librarian"
+"T1588.003","Code Signing Certificates","Resource Development","Wizard Spider"
+"T1588.002","Tool","Resource Development","MuddyWater|Silent Librarian|GALLIUM|Sandworm Team"
+"T1588.001","Malware","Resource Development","Turla|APT1"
+"T1588","Obtain Capabilities","Resource Development","no"
+"T1587.004","Exploits","Resource Development","no"
+"T1587.003","Digital Certificates","Resource Development","APT29|PROMETHIUM"
+"T1587.002","Code Signing Certificates","Resource Development","PROMETHIUM|Patchwork"
+"T1587.001","Malware","Resource Development","APT29|Lazarus Group|UNC2452|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver"
+"T1587","Develop Capabilities","Resource Development","Kimsuky"
+"T1586.002","Email Accounts","Resource Development","Magic Hound|Kimsuky"
+"T1586.001","Social Media Accounts","Resource Development","no"
+"T1586","Compromise Accounts","Resource Development","no"
+"T1585.002","Email Accounts","Resource Development","Magic Hound|Silent Librarian|Sandworm Team|APT1"
+"T1585.001","Social Media Accounts","Resource Development","Fox Kitten|Sandworm Team|APT32|Cleaver"
+"T1585","Establish Accounts","Resource Development","Fox Kitten|APT17"
+"T1584.006","Web Services","Resource Development","Turla"
+"T1584.005","Botnet","Resource Development","no"
+"T1584.004","Server","Resource Development","Indrik Spider|Turla|APT16"
+"T1584.003","Virtual Private Server","Resource Development","Turla"
+"T1584.002","DNS Server","Resource Development","no"
+"T1584.001","Domains","Resource Development","APT29|UNC2452|APT1"
+"T1583.006","Web Services","Resource Development","ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29"
+"T1583.005","Botnet","Resource Development","no"
+"T1583.004","Server","Resource Development","GALLIUM|Sandworm Team"
+"T1583.003","Virtual Private Server","Resource Development","HAFNIUM|TEMP.Veles"
+"T1583.002","DNS Server","Resource Development","no"
+"T1584","Compromise Infrastructure","Resource Development","no"
+"T1583.001","Domains","Resource Development","APT29|Mustang Panda|ZIRCONIUM|UNC2452|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28"
+"T1583","Acquire Infrastructure","Resource Development","no"
+"T1564.007","VBA Stomping","Defense Evasion","no"
+"T1558.004","AS-REP Roasting","Credential Access","no"
+"T1580","Cloud Infrastructure Discovery","Discovery","no"
+"T1218.012","Verclsid","Defense Evasion","no"
+"T1205.001","Port Knocking","Defense Evasion|Persistence|Command And Control","PROMETHIUM"
+"T1564.006","Run Virtual Instance","Defense Evasion","no"
+"T1564.005","Hidden File System","Defense Evasion","Strider|Equation"
+"T1556.003","Pluggable Authentication Modules","Credential Access|Defense Evasion|Persistence","no"
+"T1574.012","COR_PROFILER","Persistence|Privilege Escalation|Defense Evasion","Blue Mockingbird"
+"T1562.007","Disable or Modify Cloud Firewall","Defense Evasion","no"
+"T1098.004","SSH Authorized Keys","Persistence","no"
+"T1480.001","Environmental Keying","Defense Evasion","APT41|Equation"
+"T1059.007","JavaScript","Execution","MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer"
+"T1578.004","Revert Cloud Instance","Defense Evasion","no"
+"T1578.003","Delete Cloud Instance","Defense Evasion","no"
+"T1578.001","Create Snapshot","Defense Evasion","no"
+"T1578.002","Create Cloud Instance","Defense Evasion","no"
+"T1127.001","MSBuild","Defense Evasion","Frankenstein"
+"T1027.005","Indicator Removal from Tools","Defense Evasion","Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda"
+"T1562.006","Indicator Blocking","Defense Evasion","no"
+"T1573.002","Asymmetric Cryptography","Command And Control","Operation Wocao|Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6"
+"T1573.001","Symmetric Cryptography","Command And Control","Mustang Panda|Darkhotel|ZIRCONIUM|Higaisa|Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group"
+"T1573","Encrypted Channel","Command And Control","Tropic Trooper"
+"T1027.004","Compile After Delivery","Defense Evasion","Gamaredon Group|Rocke|MuddyWater"
+"T1574.004","Dylib Hijacking","Persistence|Privilege Escalation|Defense Evasion","no"
+"T1546.015","Component Object Model Hijacking","Privilege Escalation|Persistence","APT28"
+"T1071.004","DNS","Command And Control","Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7"
+"T1071.003","Mail Protocols","Command And Control","Turla|Kimsuky|APT32|SilverTerrier|APT28"
+"T1071.002","File Transfer Protocols","Command And Control","Kimsuky|APT41|SilverTerrier|Honeybee"
+"T1071.001","Web Protocols","Command And Control","APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|UNC2452|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|APT19|Cobalt Group|Rancor|Orangeworm|Threat Group-3390|Ke3chang|Turla|APT37|Dark Caracal|Lazarus Group|BRONZE BUTLER|APT32|Magic Hound|OilRig|Gamaredon Group|Stealth Falcon"
+"T1572","Protocol Tunneling","Command And Control","Chimera|Fox Kitten|OilRig|Cobalt Group|FIN6"
+"T1048.003","Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol","Exfiltration","Wizard Spider|FIN6|APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group"
+"T1048.002","Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","Exfiltration","APT29|UNC2452"
+"T1048.001","Exfiltration Over Symmetric Encrypted Non-C2 Protocol","Exfiltration","no"
+"T1001.003","Protocol Impersonation","Command And Control","Higaisa|Lazarus Group"
+"T1001.002","Steganography","Command And Control","APT29|Axiom"
+"T1001.001","Junk Data","Command And Control","APT28"
+"T1132.002","Non-Standard Encoding","Command And Control","no"
+"T1132.001","Standard Encoding","Command And Control","HAFNIUM|TA551|Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork"
+"T1090.004","Domain Fronting","Command And Control","APT29"
+"T1090.003","Multi-hop Proxy","Command And Control","APT28|Operation Wocao|Inception|FIN4|APT29"
+"T1090.002","External Proxy","Command And Control","APT39|Silence|GALLIUM|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28"
+"T1090.001","Internal Proxy","Command And Control","APT29|Higaisa|UNC2452|Operation Wocao|APT39|Strider"
+"T1102.003","One-Way Communication","Command And Control","Leviathan"
+"T1102.002","Bidirectional Communication","Command And Control","ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|FIN7|Turla|APT37|Magic Hound|Carbanak"
+"T1102.001","Dead Drop Resolver","Command And Control","Rocke|APT41|BRONZE BUTLER|RTM|Patchwork"
+"T1571","Non-Standard Port","Command And Control","Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7"
+"T1074.002","Remote Data Staging","Collection","APT29|Chimera|UNC2452|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8"
+"T1074.001","Local Data Staging","Collection","Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Honeybee|Patchwork|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28"
+"T1078.004","Cloud Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","APT33"
+"T1564.004","NTFS File Attributes","Defense Evasion","APT32"
+"T1564.003","Hidden Window","Defense Evasion","Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound"
+"T1078.003","Local Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|Stolen Pencil|APT32"
+"T1078.002","Domain Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","Indrik Spider|Chimera|Operation Wocao|Sandworm Team|Wizard Spider|APT29|TA505|APT3|Threat Group-1314"
+"T1078.001","Default Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","no"
+"T1564.002","Hidden Users","Defense Evasion","no"
+"T1574.006","Dynamic Linker Hijacking","Persistence|Privilege Escalation|Defense Evasion","APT41|Rocke"
+"T1574.002","DLL Side-Loading","Persistence|Privilege Escalation|Defense Evasion","Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390"
+"T1574.001","DLL Search Order Hijacking","Persistence|Privilege Escalation|Defense Evasion","Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass"
+"T1574.008","Path Interception by Search Order Hijacking","Persistence|Privilege Escalation|Defense Evasion","no"
+"T1574.007","Path Interception by PATH Environment Variable","Persistence|Privilege Escalation|Defense Evasion","no"
+"T1574.009","Path Interception by Unquoted Path","Persistence|Privilege Escalation|Defense Evasion","no"
+"T1574.011","Services Registry Permissions Weakness","Persistence|Privilege Escalation|Defense Evasion","no"
+"T1574.005","Executable Installer File Permissions Weakness","Persistence|Privilege Escalation|Defense Evasion","no"
+"T1574.010","Services File Permissions Weakness","Persistence|Privilege Escalation|Defense Evasion","no"
+"T1574","Hijack Execution Flow","Persistence|Privilege Escalation|Defense Evasion","no"
+"T1069.001","Local Groups","Discovery","Chimera|Operation Wocao|Turla|OilRig|admin@338"
+"T1570","Lateral Tool Transfer","Lateral Movement","Chimera|GALLIUM|Operation Wocao|APT32|Wizard Spider|Turla|FIN10"
+"T1568.003","DNS Calculation","Command And Control","APT12"
+"T1204.002","Malicious File","Execution","Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|BRONZE BUTLER|FIN7|Dragonfly 2.0|APT19|Dark Caracal|Cobalt Group|Gorgon Group|Patchwork|MuddyWater|DarkHydrus|OilRig|APT32|Rancor|Lazarus Group|APT29|APT28|APT37|FIN8|Elderwood|menuPass|PLATINUM|TA459|Leviathan"
+"T1204.001","Malicious Link","Execution","APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla"
+"T1195.003","Compromise Hardware Supply Chain","Initial Access","no"
+"T1195.002","Compromise Software Supply Chain","Initial Access","APT29|UNC2452|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41"
+"T1195.001","Compromise Software Dependencies and Development Tools","Initial Access","no"
+"T1568.001","Fast Flux DNS","Command And Control","menuPass|TA505"
+"T1052.001","Exfiltration over USB","Exfiltration","Mustang Panda|Tropic Trooper"
+"T1569.002","Service Execution","Execution","Chimera|Operation Wocao|Wizard Spider|Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang"
+"T1569.001","Launchctl","Execution","no"
+"T1569","System Services","Execution","no"
+"T1568.002","Domain Generation Algorithms","Command And Control","TA551|APT41"
+"T1568","Dynamic Resolution","Command And Control","APT29|UNC2452"
+"T1011.001","Exfiltration Over Bluetooth","Exfiltration","no"
+"T1567.002","Exfiltration to Cloud Storage","Exfiltration","ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla"
+"T1567.001","Exfiltration to Code Repository","Exfiltration","no"
+"T1059.006","Python","Execution","ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete"
+"T1059.005","Visual Basic","Execution","Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|Lazarus Group|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound"
+"T1059.004","Unix Shell","Execution","Rocke|APT41"
+"T1059.003","Windows Command Shell","Execution","APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|UNC2452|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Gorgon Group|Dark Caracal|Rancor|Ke3chang|Dragonfly 2.0|Leviathan|APT37|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|menuPass|Threat Group-3390|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1"
+"T1059.002","AppleScript","Execution","no"
+"T1059.001","PowerShell","Execution","Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Lazarus Group|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|Dragonfly 2.0|APT28|Thrip|Cobalt Group|DarkHydrus|Gorgon Group|Leviathan|TA459|MuddyWater|FIN8|Magic Hound|CopyKittens|OilRig|BRONZE BUTLER|FIN10|Threat Group-3390|APT32|FIN7|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda"
+"T1567","Exfiltration Over Web Service","Exfiltration","APT28"
+"T1497.003","Time Based Evasion","Defense Evasion|Discovery","no"
+"T1497.002","User Activity Based Checks","Defense Evasion|Discovery","Darkhotel|FIN7"
+"T1497.001","System Checks","Defense Evasion|Discovery","Darkhotel|Evilnum|Frankenstein"
+"T1498.002","Reflection Amplification","Impact","no"
+"T1498.001","Direct Network Flood","Impact","no"
+"T1566.003","Spearphishing via Service","Initial Access","Ajax Security Team|Lazarus Group|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal"
+"T1566.002","Spearphishing Link","Initial Access","Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Cobalt Group|Turla|APT28|Dragonfly 2.0|OilRig|APT33|APT29|Leviathan|Elderwood|FIN8|Patchwork|Magic Hound"
+"T1566.001","Spearphishing Attachment","Initial Access","Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|APT19|Lazarus Group|OilRig|APT32|BRONZE BUTLER|Dragonfly 2.0|MuddyWater|APT28|FIN8|TA459|Elderwood|APT29|Leviathan|Patchwork|APT37|menuPass|PLATINUM"
+"T1566","Phishing","Initial Access","GOLD SOUTHFIELD|Dragonfly"
+"T1565.003","Runtime Data Manipulation","Impact","APT38"
+"T1565.002","Transmitted Data Manipulation","Impact","APT38"
+"T1565.001","Stored Data Manipulation","Impact","FIN4|APT38"
+"T1565","Data Manipulation","Impact","no"
+"T1564.001","Hidden Files and Directories","Defense Evasion","Mustang Panda|Rocke|APT32|Tropic Trooper|Lazarus Group|APT28"
+"T1564","Hide Artifacts","Defense Evasion","no"
+"T1563.002","RDP Hijacking","Lateral Movement","no"
+"T1563.001","SSH Hijacking","Lateral Movement","no"
+"T1563","Remote Service Session Hijacking","Lateral Movement","no"
+"T1518.001","Security Software Discovery","Discovery","Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon"
+"T1069.003","Cloud Groups","Discovery","no"
+"T1069.002","Domain Groups","Discovery","Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang"
+"T1087.004","Cloud Account","Discovery","no"
+"T1087.003","Email Account","Discovery","Sandworm Team|TA505"
+"T1087.002","Domain Account","Discovery","MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|BRONZE BUTLER|OilRig|menuPass|FIN6|Poseidon Group|Ke3chang"
+"T1087.001","Local Account","Discovery","Chimera|Fox Kitten|Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338"
+"T1553.004","Install Root Certificate","Defense Evasion","no"
+"T1562.004","Disable or Modify System Firewall","Defense Evasion","APT29|UNC2452|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak"
+"T1562.003","Impair Command History Logging","Defense Evasion","no"
+"T1562.002","Disable Windows Event Logging","Defense Evasion","APT29|UNC2452|Threat Group-3390"
+"T1562.001","Disable or Modify Tools","Defense Evasion","APT29|MuddyWater|UNC2452|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda"
+"T1562","Impair Defenses","Defense Evasion","no"
+"T1003.004","LSA Secrets","Credential Access","OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390"
+"T1003.005","Cached Domain Credentials","Credential Access","OilRig|MuddyWater|Leafminer|APT33"
+"T1561.002","Disk Structure Wipe","Impact","Sandworm Team|Lazarus Group|APT38|APT37"
+"T1561.001","Disk Content Wipe","Impact","Lazarus Group"
+"T1561","Disk Wipe","Impact","no"
+"T1560.003","Archive via Custom Method","Collection","Mustang Panda|Lazarus Group|Kimsuky|CopyKittens|FIN6"
+"T1560.002","Archive via Library","Collection","Lazarus Group|Threat Group-3390"
+"T1560.001","Archive via Utility","Collection","APT29|Mustang Panda|HAFNIUM|UNC2452|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang"
+"T1560","Archive Collected Data","Collection","menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang"
+"T1499.004","Application or System Exploitation","Impact","no"
+"T1499.003","Application Exhaustion Flood","Impact","no"
+"T1499.002","Service Exhaustion Flood","Impact","no"
+"T1499.001","OS Exhaustion Flood","Impact","no"
+"T1491.002","External Defacement","Impact","Sandworm Team"
+"T1491.001","Internal Defacement","Impact","Lazarus Group"
+"T1114.003","Email Forwarding Rule","Collection","Silent Librarian|Kimsuky"
+"T1114.002","Remote Email Collection","Collection","APT29|HAFNIUM|Chimera|UNC2452|APT1|FIN4|Dragonfly 2.0|APT28|Leafminer|Ke3chang"
+"T1114.001","Local Email Collection","Collection","Chimera|Magic Hound|APT1"
+"T1134.005","SID-History Injection","Defense Evasion|Privilege Escalation","no"
+"T1134.004","Parent PID Spoofing","Defense Evasion|Privilege Escalation","no"
+"T1134.003","Make and Impersonate Token","Defense Evasion|Privilege Escalation","no"
+"T1134.002","Create Process with Token","Defense Evasion|Privilege Escalation","Turla|Lazarus Group"
+"T1134.001","Token Impersonation/Theft","Defense Evasion|Privilege Escalation","APT28"
+"T1213.002","Sharepoint","Collection","Chimera|Ke3chang|APT28"
+"T1213.001","Confluence","Collection","no"
+"T1555.003","Credentials from Web Browsers","Credential Access","Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats"
+"T1555.002","Securityd Memory","Credential Access","no"
+"T1555.001","Keychain","Credential Access","no"
+"T1559.002","Dynamic Data Exchange","Execution","Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7"
+"T1559.001","Component Object Model","Execution","Gamaredon Group|MuddyWater"
+"T1559","Inter-Process Communication","Execution","no"
+"T1558.002","Silver Ticket","Credential Access","no"
+"T1558.001","Golden Ticket","Credential Access","Ke3chang"
+"T1558","Steal or Forge Kerberos Tickets","Credential Access","no"
+"T1557.001","LLMNR/NBT-NS Poisoning and SMB Relay","Credential Access|Collection","Wizard Spider"
+"T1557","Man-in-the-Middle","Credential Access|Collection","Kimsuky"
+"T1556.002","Password Filter DLL","Credential Access|Defense Evasion|Persistence","Strider"
+"T1556.001","Domain Controller Authentication","Credential Access|Defense Evasion|Persistence","Chimera"
+"T1556","Modify Authentication Process","Credential Access|Defense Evasion|Persistence","no"
+"T1056.004","Credential API Hooking","Collection|Credential Access","PLATINUM"
+"T1056.003","Web Portal Capture","Collection|Credential Access","no"
+"T1056.002","GUI Input Capture","Collection|Credential Access","FIN4"
+"T1056.001","Keylogging","Collection|Credential Access","Ajax Security Team|Operation Wocao|APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28"
+"T1555","Credentials from Password Stores","Credential Access","APT29|Evilnum|UNC2452|FIN6|APT39|OilRig|MuddyWater|Leafminer|APT33|Stealth Falcon"
+"T1552.005","Cloud Instance Metadata API","Credential Access","no"
+"T1003.008","/etc/passwd and /etc/shadow","Credential Access","no"
+"T1003.007","Proc Filesystem","Credential Access","no"
+"T1003.006","DCSync","Credential Access","APT29|UNC2452|Operation Wocao"
+"T1558.003","Kerberoasting","Credential Access","APT29|UNC2452|Operation Wocao|Wizard Spider"
+"T1552.006","Group Policy Preferences","Credential Access","APT33"
+"T1003.003","NTDS","Credential Access","Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0"
+"T1003.002","Security Account Manager","Credential Access","Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass"
+"T1003.001","LSASS Memory","Credential Access","HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Leafminer|Magic Hound|Lazarus Group|MuddyWater|PLATINUM|FIN8|OilRig|BRONZE BUTLER|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver"
+"T1110.004","Credential Stuffing","Credential Access","Chimera"
+"T1110.003","Password Spraying","Credential Access","Silent Librarian|Chimera|APT28|APT33|Leafminer|Lazarus Group"
+"T1110.002","Password Cracking","Credential Access","FIN6|APT41|Dragonfly 2.0|APT3"
+"T1110.001","Password Guessing","Credential Access","APT28"
+"T1021.006","Windows Remote Management","Lateral Movement","APT29|UNC2452|Chimera|Wizard Spider|Threat Group-3390"
+"T1021.005","VNC","Lateral Movement","Fox Kitten|GCMAN"
+"T1021.004","SSH","Lateral Movement","Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN"
+"T1021.003","Distributed Component Object Model","Lateral Movement","no"
+"T1021.002","SMB/Windows Admin Shares","Lateral Movement","Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang"
+"T1021.001","Remote Desktop Protocol","Lateral Movement","Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom"
+"T1554","Compromise Client Software Binary","Persistence","no"
+"T1036.006","Space after Filename","Defense Evasion","no"
+"T1036.005","Match Legitimate Name or Location","Defense Evasion","APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|UNC2452|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1"
+"T1036.004","Masquerade Task or Service","Defense Evasion","ZIRCONIUM|APT29|Higaisa|UNC2452|Fox Kitten|Kimsuky|Lazarus Group|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7"
+"T1036.003","Rename System Utilities","Defense Evasion","menuPass|APT32|GALLIUM"
+"T1036.002","Right-to-Left Override","Defense Evasion","BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic"
+"T1036.001","Invalid Code Signature","Defense Evasion","Windshift|APT37"
+"T1553.003","SIP and Trust Provider Hijacking","Defense Evasion","no"
+"T1553.002","Code Signing","Defense Evasion","APT29|GALLIUM|UNC2452|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel"
+"T1553.001","Gatekeeper Bypass","Defense Evasion","no"
+"T1553","Subvert Trust Controls","Defense Evasion","no"
+"T1027.003","Steganography","Defense Evasion","TA551|BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37"
+"T1027.002","Software Packing","Defense Evasion","ZIRCONIUM|Lazarus Group|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon"
+"T1027.001","Binary Padding","Defense Evasion","Mustang Panda|Higaisa|Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee"
+"T1222.002","Linux and Mac File and Directory Permissions Modification","Defense Evasion","Rocke|APT32"
+"T1222.001","Windows File and Directory Permissions Modification","Defense Evasion","Wizard Spider"
+"T1552.004","Private Keys","Credential Access","APT29|UNC2452|Operation Wocao|Rocke"
+"T1552.003","Bash History","Credential Access","no"
+"T1552.002","Credentials in Registry","Credential Access","APT32"
+"T1552.001","Credentials In Files","Credential Access","Fox Kitten|Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3"
+"T1552","Unsecured Credentials","Credential Access","no"
+"T1216.001","PubPrn","Defense Evasion","APT32"
+"T1070.006","Timestomp","Defense Evasion","APT29|UNC2452|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28"
+"T1070.005","Network Share Connection Removal","Defense Evasion","Threat Group-3390"
+"T1070.004","File Deletion","Defense Evasion","APT39|Mustang Panda|Chimera|Evilnum|UNC2452|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|Threat Group-3390|FIN10|APT28|Group5|Lazarus Group|APT18|APT29"
+"T1070.003","Clear Command History","Defense Evasion","APT41"
+"T1550.004","Web Session Cookie","Defense Evasion|Lateral Movement","APT29|UNC2452"
+"T1550.001","Application Access Token","Defense Evasion|Lateral Movement","APT28"
+"T1550.003","Pass the Ticket","Defense Evasion|Lateral Movement","APT32|BRONZE BUTLER|APT29"
+"T1550.002","Pass the Hash","Defense Evasion|Lateral Movement","Chimera|Kimsuky|GALLIUM|APT32|Night Dragon|APT28|APT1"
+"T1550","Use Alternate Authentication Material","Defense Evasion|Lateral Movement","APT29|UNC2452"
+"T1548.004","Elevated Execution with Prompt","Privilege Escalation|Defense Evasion","no"
+"T1548.003","Sudo and Sudo Caching","Privilege Escalation|Defense Evasion","no"
+"T1548.002","Bypass User Account Control","Privilege Escalation|Defense Evasion","Evilnum|APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29"
+"T1548.001","Setuid and Setgid","Privilege Escalation|Defense Evasion","no"
+"T1548","Abuse Elevation Control Mechanism","Privilege Escalation|Defense Evasion","no"
+"T1136.003","Cloud Account","Persistence","no"
+"T1070.002","Clear Linux or Mac System Logs","Defense Evasion","Rocke"
+"T1070.001","Clear Windows Event Logs","Defense Evasion","Chimera|Operation Wocao|APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28"
+"T1136.002","Domain Account","Persistence","HAFNIUM|GALLIUM"
+"T1136.001","Local Account","Persistence","Fox Kitten|APT39|APT41|Dragonfly 2.0|Leafminer|APT3"
+"T1547.011","Plist Modification","Persistence|Privilege Escalation","no"
+"T1547.010","Port Monitors","Persistence|Privilege Escalation","no"
+"T1547.009","Shortcut Modification","Persistence|Privilege Escalation","APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Lazarus Group|Leviathan"
+"T1547.008","LSASS Driver","Persistence|Privilege Escalation","no"
+"T1547.007","Re-opened Applications","Persistence|Privilege Escalation","no"
+"T1547.006","Kernel Modules and Extensions","Persistence|Privilege Escalation","no"
+"T1547.005","Security Support Provider","Persistence|Privilege Escalation","Lazarus Group"
+"T1547.004","Winlogon Helper DLL","Persistence|Privilege Escalation","Wizard Spider|Tropic Trooper|Turla"
+"T1547.003","Time Providers","Persistence|Privilege Escalation","no"
+"T1546.014","Emond","Privilege Escalation|Persistence","no"
+"T1546.013","PowerShell Profile","Privilege Escalation|Persistence","Turla"
+"T1546.012","Image File Execution Options Injection","Privilege Escalation|Persistence","TEMP.Veles"
+"T1218.008","Odbcconf","Defense Evasion","Cobalt Group"
+"T1546.011","Application Shimming","Privilege Escalation|Persistence","FIN7"
+"T1547.002","Authentication Package","Persistence|Privilege Escalation","no"
+"T1546.010","AppInit DLLs","Privilege Escalation|Persistence","APT39"
+"T1546.009","AppCert DLLs","Privilege Escalation|Persistence","Honeybee"
+"T1218.007","Msiexec","Defense Evasion","ZIRCONIUM|Molerats|Machete|TA505|Rancor"
+"T1546.008","Accessibility Features","Privilege Escalation|Persistence","Fox Kitten|APT41|APT3|APT29|Deep Panda|Axiom"
+"T1546.007","Netsh Helper DLL","Privilege Escalation|Persistence","no"
+"T1546.006","LC_LOAD_DYLIB Addition","Privilege Escalation|Persistence","no"
+"T1546.005","Trap","Privilege Escalation|Persistence","no"
+"T1546.004","Unix Shell Configuration Modification","Privilege Escalation|Persistence","no"
+"T1546.003","Windows Management Instrumentation Event Subscription","Privilege Escalation|Persistence","Mustang Panda|UNC2452|APT33|Blue Mockingbird|Turla|Leviathan|APT29"
+"T1546.002","Screensaver","Privilege Escalation|Persistence","no"
+"T1546.001","Change Default File Association","Privilege Escalation|Persistence","Kimsuky"
+"T1547.001","Registry Run Keys / Startup Folder","Persistence|Privilege Escalation","Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Turla|APT19|Honeybee|Dark Caracal|Threat Group-3390|Cobalt Group|Ke3chang|Gorgon Group|Dragonfly 2.0|APT37|MuddyWater|Leviathan|APT3|BRONZE BUTLER|Magic Hound|FIN7|FIN10|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel"
+"T1218.002","Control Panel","Defense Evasion","no"
+"T1218.010","Regsvr32","Defense Evasion","TA551|Blue Mockingbird|Inception|WIRTE|APT19|Cobalt Group|Leviathan|APT32|Deep Panda"
+"T1218.009","Regsvcs/Regasm","Defense Evasion","no"
+"T1218.005","Mshta","Defense Evasion","Mustang Panda|TA551|Sidewinder|Lazarus Group|Inception|Kimsuky|APT32|MuddyWater|FIN7"
+"T1218.004","InstallUtil","Defense Evasion","Mustang Panda|menuPass"
+"T1218.001","Compiled HTML File","Defense Evasion","APT41|Silence|Lazarus Group|Dark Caracal|OilRig"
+"T1218.003","CMSTP","Defense Evasion","Cobalt Group|MuddyWater"
+"T1218.011","Rundll32","Defense Evasion","HAFNIUM|TA551|UNC2452|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28"
+"T1547","Boot or Logon Autostart Execution","Persistence|Privilege Escalation","no"
+"T1546","Event Triggered Execution","Privilege Escalation|Persistence","no"
+"T1098.003","Add Office 365 Global Administrator Role","Persistence","no"
+"T1098.002","Exchange Email Delegate Permissions","Persistence","APT29|UNC2452|Magic Hound"
+"T1098.001","Additional Cloud Credentials","Persistence","APT29|UNC2452"
+"T1543.004","Launch Daemon","Persistence|Privilege Escalation","no"
+"T1543.003","Windows Service","Persistence|Privilege Escalation","PROMETHIUM|Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|FIN7|APT19|Honeybee|Threat Group-3390|APT3|Lazarus Group|Carbanak"
+"T1543.002","Systemd Service","Persistence|Privilege Escalation","Rocke"
+"T1543.001","Launch Agent","Persistence|Privilege Escalation","no"
+"T1037.005","Startup Items","Persistence|Privilege Escalation","no"
+"T1037.004","RC Scripts","Persistence|Privilege Escalation","no"
+"T1055.012","Process Hollowing","Defense Evasion|Privilege Escalation","Threat Group-3390|Gorgon Group|menuPass|Patchwork"
+"T1055.013","Process Doppelgänging","Defense Evasion|Privilege Escalation","Leafminer"
+"T1055.011","Extra Window Memory Injection","Defense Evasion|Privilege Escalation","no"
+"T1055.014","VDSO Hijacking","Defense Evasion|Privilege Escalation","no"
+"T1055.009","Proc Memory","Defense Evasion|Privilege Escalation","no"
+"T1055.008","Ptrace System Calls","Defense Evasion|Privilege Escalation","no"
+"T1055.005","Thread Local Storage","Defense Evasion|Privilege Escalation","no"
+"T1055.004","Asynchronous Procedure Call","Defense Evasion|Privilege Escalation","no"
+"T1055.003","Thread Execution Hijacking","Defense Evasion|Privilege Escalation","no"
+"T1055.002","Portable Executable Injection","Defense Evasion|Privilege Escalation","Rocke|Gorgon Group"
+"T1055.001","Dynamic-link Library Injection","Defense Evasion|Privilege Escalation","Wizard Spider|TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda"
+"T1037.003","Network Logon Script","Persistence|Privilege Escalation","no"
+"T1543","Create or Modify System Process","Persistence|Privilege Escalation","no"
+"T1037.002","Logon Script (Mac)","Persistence|Privilege Escalation","no"
+"T1037.001","Logon Script (Windows)","Persistence|Privilege Escalation","Cobalt Group|APT28"
+"T1542.003","Bootkit","Persistence|Defense Evasion","APT41|Lazarus Group|APT28"
+"T1542.002","Component Firmware","Persistence|Defense Evasion","Equation"
+"T1542.001","System Firmware","Persistence|Defense Evasion","no"
+"T1505.003","Web Shell","Persistence","Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda"
+"T1505.002","Transport Agent","Persistence","no"
+"T1505.001","SQL Stored Procedures","Persistence","no"
+"T1053.003","Cron","Execution|Persistence|Privilege Escalation","Rocke"
+"T1053.004","Launchd","Execution|Persistence|Privilege Escalation","no"
+"T1053.001","At (Linux)","Execution|Persistence|Privilege Escalation","no"
+"T1053.005","Scheduled Task","Execution|Persistence|Privilege Escalation","Mustang Panda|Higaisa|UNC2452|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Cobalt Group|Rancor|Dragonfly 2.0|OilRig|Patchwork|FIN8|menuPass|FIN10|FIN7|APT32|Stealth Falcon|FIN6|APT3|APT29"
+"T1053.002","At (Windows)","Execution|Persistence|Privilege Escalation","BRONZE BUTLER|Threat Group-3390|APT18"
+"T1542","Pre-OS Boot","Defense Evasion|Persistence","no"
+"T1137.001","Office Template Macros","Persistence","MuddyWater"
+"T1137.004","Outlook Home Page","Persistence","OilRig"
+"T1137.003","Outlook Forms","Persistence","no"
+"T1137.005","Outlook Rules","Persistence","no"
+"T1137.006","Add-ins","Persistence","Naikon"
+"T1137.002","Office Test","Persistence","APT28"
+"T1531","Account Access Removal","Impact","no"
+"T1539","Steal Web Session Cookie","Credential Access","Evilnum"
+"T1529","System Shutdown/Reboot","Impact","Lazarus Group|APT38|APT37"
+"T1518","Software Discovery","Discovery","Mustang Panda|Windshift|MuddyWater|Windigo|Sidewinder|Operation Wocao|BRONZE BUTLER|Tropic Trooper|Inception"
+"T1547.013","XDG Autostart Entries","Persistence|Privilege Escalation","no"
+"T1534","Internal Spearphishing","Lateral Movement","Gamaredon Group"
+"T1528","Steal Application Access Token","Credential Access","APT28"
+"T1535","Unused/Unsupported Cloud Regions","Defense Evasion","no"
+"T1525","Implant Internal Image","Persistence","no"
+"T1538","Cloud Service Dashboard","Discovery","no"
+"T1530","Data from Cloud Storage Object","Collection","Fox Kitten"
+"T1578","Modify Cloud Compute Infrastructure","Defense Evasion","no"
+"T1537","Transfer Data to Cloud Account","Exfiltration","no"
+"T1526","Cloud Service Discovery","Discovery","no"
+"T1505","Server Software Component","Persistence","no"
+"T1499","Endpoint Denial of Service","Impact","Sandworm Team"
+"T1497","Virtualization/Sandbox Evasion","Defense Evasion|Discovery","Darkhotel"
+"T1498","Network Denial of Service","Impact","APT28"
+"T1496","Resource Hijacking","Impact","Blue Mockingbird|Rocke|APT41|Lazarus Group"
+"T1495","Firmware Corruption","Impact","no"
+"T1491","Defacement","Impact","no"
+"T1490","Inhibit System Recovery","Impact","no"
+"T1489","Service Stop","Impact","Wizard Spider|Lazarus Group"
+"T1486","Data Encrypted for Impact","Impact","Indrik Spider|APT41|TA505|APT38"
+"T1485","Data Destruction","Impact","Sandworm Team|Lazarus Group|APT38"
+"T1484","Domain Policy Modification","Defense Evasion|Privilege Escalation","no"
+"T1482","Domain Trust Discovery","Discovery","APT29|Chimera|UNC2452"
+"T1480","Execution Guardrails","Defense Evasion","no"
+"T1222","File and Directory Permissions Modification","Defense Evasion","no"
+"T1220","XSL Script Processing","Defense Evasion","Higaisa|Cobalt Group"
+"T1221","Template Injection","Defense Evasion","Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus"
+"T1189","Drive-by Compromise","Initial Access","Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|Leafminer|Lazarus Group|BRONZE BUTLER|APT19|APT32|Threat Group-3390|Dark Caracal|Elderwood|APT37|Patchwork|PLATINUM"
+"T1190","Exploit Public-Facing Application","Initial Access","Volatile Cedar|UNC2452|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom"
+"T1210","Exploitation of Remote Services","Lateral Movement","Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28"
+"T1217","Browser Bookmark Discovery","Discovery","Chimera|Fox Kitten"
+"T1213","Data from Information Repositories","Collection","Fox Kitten|FIN6|Turla"
+"T1197","BITS Jobs","Defense Evasion|Persistence","APT39|Patchwork|APT41|Leviathan"
+"T1219","Remote Access Software","Command And Control","Mustang Panda|MuddyWater|Evilnum|GOLD SOUTHFIELD|Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak"
+"T1195","Supply Chain Compromise","Initial Access","no"
+"T1204","User Execution","Execution","no"
+"T1212","Exploitation for Credential Access","Credential Access","no"
+"T1211","Exploitation for Defense Evasion","Defense Evasion","APT28"
+"T1200","Hardware Additions","Initial Access","DarkVishnya"
+"T1202","Indirect Command Execution","Defense Evasion","no"
+"T1201","Password Policy Discovery","Discovery","Chimera|Turla|OilRig"
+"T1207","Rogue Domain Controller","Defense Evasion","no"
+"T1203","Exploitation for Client Execution","Execution","Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Lazarus Group|Cobalt Group|APT37|Patchwork|APT29|TA459|Leviathan|Elderwood"
+"T1216","Signed Script Proxy Execution","Defense Evasion","no"
+"T1199","Trusted Relationship","Initial Access","Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass"
+"T1218","Signed Binary Proxy Execution","Defense Evasion","no"
+"T1205","Traffic Signaling","Defense Evasion|Persistence|Command And Control","no"
+"T1176","Browser Extensions","Persistence","Kimsuky|Stolen Pencil"
+"T1175","Component Object Model and Distributed COM","Lateral Movement|Execution","no"
+"T1187","Forced Authentication","Credential Access","DarkHydrus|Dragonfly 2.0"
+"T1185","Man in the Browser","Collection","no"
+"T1149","LC_MAIN Hijacking","Defense Evasion","no"
+"T1134","Access Token Manipulation","Defense Evasion|Privilege Escalation","FIN6|Blue Mockingbird"
+"T1136","Create Account","Persistence","no"
+"T1137","Office Application Startup","Persistence","Gamaredon Group|APT32"
+"T1140","Deobfuscate/Decode Files or Information","Defense Evasion","APT39|APT29|ZIRCONIUM|Higaisa|UNC2452|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Gorgon Group|menuPass|Honeybee|Threat Group-3390|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER"
+"T1135","Network Share Discovery","Discovery","Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug"
+"T1153","Source","Execution","no"
+"T1133","External Remote Services","Persistence|Initial Access","APT29|UNC2452|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18"
+"T1132","Data Encoding","Command And Control","no"
+"T1129","Shared Modules","Execution","no"
+"T1127","Trusted Developer Utilities Proxy Execution","Defense Evasion","no"
+"T1125","Video Capture","Collection","Silence|FIN7"
+"T1124","System Time Discovery","Discovery","Darkhotel|ZIRCONIUM|Higaisa|Sidewinder|Chimera|Operation Wocao|The White Company|Lazarus Group|BRONZE BUTLER|Turla"
+"T1123","Audio Capture","Collection","APT37"
+"T1120","Peripheral Device Discovery","Discovery","Operation Wocao|Turla|APT37|Gamaredon Group|Equation|APT28"
+"T1119","Automated Collection","Collection","Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6"
+"T1115","Clipboard Data","Collection","Operation Wocao|APT39|APT38"
+"T1114","Email Collection","Collection","Silent Librarian"
+"T1113","Screen Capture","Collection","GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|OilRig|Dragonfly 2.0|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28"
+"T1112","Modify Registry","Defense Evasion","Operation Wocao|Kimsuky|Lazarus Group|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Patchwork|Gorgon Group|Honeybee|FIN8"
+"T1111","Two-Factor Authentication Interception","Credential Access","Chimera|Operation Wocao"
+"T1110","Brute Force","Credential Access","APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla"
+"T1108","Redundant Access","Defense Evasion|Persistence","no"
+"T1106","Native API","Execution","Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group"
+"T1105","Ingress Tool Transfer","Command And Control","HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|UNC2452|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Gorgon Group|Turla|OilRig|Dragonfly 2.0|APT37|Leviathan|FIN8|PLATINUM|Elderwood|APT3|Magic Hound|APT32|BRONZE BUTLER|FIN7|menuPass|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28"
+"T1104","Multi-Stage Channels","Command And Control","APT41|MuddyWater|APT3"
+"T1102","Web Service","Command And Control","Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6"
+"T1098","Account Manipulation","Persistence","APT3|Dragonfly 2.0|Lazarus Group"
+"T1095","Non-Application Layer Protocol","Command And Control","HAFNIUM|Operation Wocao|FIN6|APT29|PLATINUM|APT3"
+"T1092","Communication Through Removable Media","Command And Control","APT28"
+"T1091","Replication Through Removable Media","Lateral Movement|Initial Access","Mustang Panda|Tropic Trooper|Darkhotel|APT28"
+"T1090","Proxy","Command And Control","Windigo|Fox Kitten|Operation Wocao|Sandworm Team|Blue Mockingbird|APT41|Turla"
+"T1087","Account Discovery","Discovery","APT29|UNC2452"
+"T1083","File and Directory Discovery","Discovery","APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|UNC2452|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Dragonfly 2.0|Leafminer|Honeybee|Dark Caracal|Magic Hound|APT3|BRONZE BUTLER|Sowbug|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang"
+"T1082","System Information Discovery","Discovery","APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|UNC2452|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT37|APT19|Honeybee|APT32|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang"
+"T1080","Taint Shared Content","Lateral Movement","Gamaredon Group|BRONZE BUTLER|Darkhotel"
+"T1078","Valid Accounts","Defense Evasion|Persistence|Privilege Escalation|Initial Access","APT29|Silent Librarian|UNC2452|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|Leviathan|OilRig|FIN5|menuPass|FIN10|APT28|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak"
+"T1074","Data Staged","Collection","Wizard Spider"
+"T1072","Software Deployment Tools","Execution|Lateral Movement","Silence|APT32|Threat Group-1314"
+"T1071","Application Layer Protocol","Command And Control","Rocke|Magic Hound|Dragonfly 2.0"
+"T1070","Indicator Removal on Host","Defense Evasion","APT29|UNC2452"
+"T1069","Permission Groups Discovery","Discovery","APT29|UNC2452|TA505|APT3"
+"T1068","Exploitation for Privilege Escalation","Privilege Escalation","ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28"
+"T1064","Scripting","Defense Evasion|Execution","no"
+"T1062","Hypervisor","Persistence","no"
+"T1061","Graphical User Interface","Execution","no"
+"T1059","Command and Scripting Interpreter","Execution","Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang"
+"T1057","Process Discovery","Discovery","APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|UNC2452|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang"
+"T1056","Input Capture","Collection|Credential Access","APT39"
+"T1055","Process Injection","Defense Evasion|Privilege Escalation","Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM"
+"T1053","Scheduled Task/Job","Execution|Persistence|Privilege Escalation","no"
+"T1052","Exfiltration Over Physical Medium","Exfiltration","no"
+"T1051","Shared Webroot","Lateral Movement","no"
+"T1049","System Network Connections Discovery","Discovery","Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|APT3|OilRig|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang"
+"T1048","Exfiltration Over Alternative Protocol","Exfiltration","no"
+"T1047","Windows Management Instrumentation","Execution","Mustang Panda|Windshift|UNC2452|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|OilRig|Threat Group-3390|Leviathan|FIN8|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda"
+"T1046","Network Service Scanning","Discovery","Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|OilRig|Leafminer|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390"
+"T1043","Commonly Used Port","Command And Control","OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|FIN7|Dragonfly 2.0|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390"
+"T1041","Exfiltration Over C2 Channel","Exfiltration","ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang"
+"T1040","Network Sniffing","Credential Access|Discovery","Kimsuky|Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28"
+"T1039","Data from Network Shared Drive","Collection","Chimera|Fox Kitten|Gamaredon Group|Sowbug|BRONZE BUTLER|menuPass"
+"T1037","Boot or Logon Initialization Scripts","Persistence|Privilege Escalation","Rocke"
+"T1036","Masquerading","Defense Evasion","APT29|Mustang Panda|ZIRCONIUM|TA551|UNC2452|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0"
+"T1034","Path Interception","Persistence|Privilege Escalation","no"
+"T1033","System Owner/User Discovery","Discovery","Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3"
+"T1030","Data Transfer Size Limits","Exfiltration","Threat Group-3390"
+"T1029","Scheduled Transfer","Exfiltration","Higaisa"
+"T1027","Obfuscated Files or Information","Defense Evasion","APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Patchwork|APT37|Honeybee|menuPass|Leafminer|Cobalt Group|Threat Group-3390|Dark Caracal|APT19|FIN8|BlackOasis|MuddyWater|Elderwood|Leviathan|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28"
+"T1026","Multiband Communication","Command And Control","Lazarus Group"
+"T1025","Data from Removable Media","Collection","Turla|Gamaredon Group|APT28"
+"T1021","Remote Services","Lateral Movement","no"
+"T1020","Automated Exfiltration","Exfiltration","Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee"
+"T1018","Remote System Discovery","Discovery","APT29|UNC2452|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Dragonfly 2.0|Deep Panda|Threat Group-3390|Leafminer|Ke3chang|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla"
+"T1016","System Network Configuration Discovery","Discovery","ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|OilRig|Magic Hound|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang"
+"T1014","Rootkit","Defense Evasion","Rocke|APT41|APT28|Winnti Group"
+"T1012","Query Registry","Discovery","ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla"
+"T1011","Exfiltration Over Other Network Medium","Exfiltration","no"
+"T1010","Application Window Discovery","Discovery","Lazarus Group"
+"T1008","Fallback Channels","Command And Control","Carbanak|APT41|OilRig|Lazarus Group"
+"T1007","System Service Discovery","Discovery","Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang"
+"T1006","Direct Volume Access","Defense Evasion","no"
+"T1005","Data from Local System","Collection","APT29|Windigo|UNC2452|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dragonfly 2.0|Dark Caracal|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang"
+"T1003","OS Credential Dumping","Credential Access","APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom"
+"T1001","Data Obfuscation","Command And Control","Operation Wocao|Axiom"

dist/devsecops/lookups/network_acl_activity_baseline.csv

@@ -0,0 +1 @@
+arn,latestCount,numDataPoints,avgApiCalls,stdevApiCalls

dist/devsecops/lookups/previously_seen_S3_access_from_remote_ip.csv

@@ -0,0 +1 @@
+bucket_name,remote_ip,earliest,latest

dist/devsecops/lookups/previously_seen_api_calls_from_user_roles.csv

@@ -0,0 +1 @@
+earliest,latest,userName,eventName

dist/devsecops/lookups/previously_seen_aws_cross_account_activity.csv

@@ -0,0 +1 @@
+firstTime,lastTime,requestingAccountId,requestedAccountId

dist/devsecops/lookups/previously_seen_aws_regions.csv

@@ -0,0 +1 @@
+earliest,latest,awsRegion

dist/devsecops/lookups/previously_seen_cmd_line_arguments.csv

@@ -0,0 +1 @@
+firstTime,lastTime,process

dist/devsecops/lookups/previously_seen_ec2_modifications_by_user.csv

@@ -0,0 +1 @@
+arn,firstTime,lastTime

dist/devsecops/lookups/prohibited_apps_launching_cmd.csv

@@ -0,0 +1,17 @@
+prohibited_applications,isProhibited
+winword.exe,prohibited
+EXCEL.EXE,prohibited
+OUTLOOK.EXE,prohibited
+POWERPNT.EXE,prohibited
+visio.exe,prohibited
+mspub.exe,prohibited
+Acrobat.exe,prohibited
+Acrord32.exe,prohibited
+chrome.exe,prohibited
+iexplore.exe,prohibited
+opera.exe,prohibited
+firefox.exe,prohibited
+java.exe,prohibited
+powershell.exe,prohibited
+mshta.exe, prohibited
+zoom.exe,prohibitied

dist/devsecops/lookups/prohibited_processes.csv

@@ -0,0 +1,20 @@
+app,note
+remcom.exe,ESCU - This process is an open source replacement to psexec and is not typically seen in an enterprise environment.
+pwdump.exe,ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
+pwdump2.exe,ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
+nc.exe,ESCU - This process is an open source tool used for network communications.
+wce.exe,ESCU - This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
+cain.exe,ESCU - This process is associated with a tool used to collect user credentials and execute attacks.
+nmap.exe,ESCU - This process is an open source network mapping tool used to identify hosts and listening services on a network.
+kidlogger.exe,ESCU - This process is associated with a tool used to collect keyboard input on a host.
+isass.exe,ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
+svch0st.exe,ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
+at.exe,ESCU - This process is used to schedule other processes to run.  schtasks.exe should be used instead as it provides more flexibility.
+getmail.exe,ESCU - This process is seen to be used by attackers to extract email files from host machines.
+ntdll.exe,ESCU - This process was identified as malicious by DHS Alert TA18-074A.
+netpass.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and attackers use this tool to recover all network passwords stored on your system for the current logged-on user.
+WebBrowserPassView.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers as a password recovery tool that reveals the passwords stored in Web Browsers.
+OutlookAddressBookView.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook.
+mailpv.exe,ESCU - This process was identified by DHS Alert TA18-201A and attackers use this tool is a password-recovery tool that reveals the passwords and other account details from various email clients.
+NLBrute.exe,ESCU - This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords.
+selfdel.exe,ESCU - This executable was delivered in the SamSam Ransomware Campain and the attackers levereged this binary to delete its malicilous activities.

dist/devsecops/lookups/prohibited_softwares.csv

@@ -0,0 +1,20 @@
+app,note
+remcom.exe,ESCU - This process is an open source replacement to psexec and is not typically seen in an enterprise environment.
+pwdump.exe,ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
+pwdump2.exe,ESCU - This process is associated with a tool used to dump password hashes on a Windows system.
+nc.exe,ESCU - This process is an open source tool used for network communications.
+wce.exe,ESCU - This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
+cain.exe,ESCU - This process is associated with a tool used to collect user credentials and execute attacks.
+nmap.exe,ESCU - This process is an open source network mapping tool used to identify hosts and listening services on a network.
+kidlogger.exe,ESCU - This process is associated with a tool used to collect keyboard input on a host.
+isass.exe,ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
+svch0st.exe,ESCU - This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
+at.exe,ESCU - This process is used to schedule other processes to run.  schtasks.exe should be used instead as it provides more flexibility.
+getmail.exe,ESCU - This process is seen to be used by attackers to extract email files from host machines.
+ntdll.exe,ESCU - This process was identified as malicious by DHS Alert TA18-074A.
+netpass.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and attackers use this tool to recover all network passwords stored on your system for the current logged-on user.
+WebBrowserPassView.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers as a password recovery tool that reveals the passwords stored in Web Browsers.
+OutlookAddressBookView.exe,ESCU - This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook.
+mailpv.exe,ESCU - This process was identified by DHS Alert TA18-201A and attackers use this tool is a password-recovery tool that reveals the passwords and other account details from various email clients.
+NLBrute.exe,ESCU - This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords.
+selfdel.exe,ESCU - This executable was delivered in the SamSam Ransomware Campain and the attackers levereged this binary to delete its malicilous activities.

dist/devsecops/lookups/ransomware_extensions.csv

@@ -0,0 +1,299 @@
+Extensions,Name
+.enc,.CryptoHasYou.
+.777,777
+.R4A,7ev3n
+.R5A,7ev3n
+.7h9r,7h9r
+.8lock8,8lock8
+.encrypt,Alpha Ransomware
+.amba,AMBA
+.adk,Angry Duck
+.encrypted,Apocalypse
+.SecureCrypted,Apocalypse
+.FuckYourData,Apocalypse
+.unavailable,Apocalypse
+.bleepYourFiles,Apocalypse
+.Where_my_files.txt,Apocalypse
+.encrypted,ApocalypseVM
+.locked,ApocalypseVM
+.locky,AutoLocky
+.adr,BaksoCrypt
+.bart.zip,Bart
+.bart,Bart
+.perl,Bart
+.clf,BitCryptor
+.bitstak,BitStak
+.Silent,BlackShades Crypter
+.blocatto,Blocatto
+.lock,Brazilian
+.cry,Central Security Treatment Organization
+.cerber,Cerber
+.cerber2,Cerber
+.cerber3,Cerber
+.clf,CoinVault
+.coverton,Coverton
+.enigma,Coverton
+.czvxce,Coverton
+.criptiko,CryFile
+.criptoko,CryFile
+.criptokod,CryFile
+.cripttt,CryFile
+.aga,CryFile
+.cry,CryLocker
+.ENCRYPTED,Crypren
+.crypt38,Crypt38
+.scl,CryptFIle2
+.crinf,CryptInfinite
+.frtrss,CryptoFortress
+.clf,CryptoGraphic Locker
+.crjoker,CryptoJoker
+.encrypted ,CryptoLocker
+.ENC,CryptoLocker
+.code,CryptoMix
+.scl,CryptoMix
+.crptrgr,CryptoRoger
+.locked,CryptoShocker
+.CryptoTorLocker2015!,CryptoTorLocker2015
+.crypt,CryptXXX
+.crypt,CryptXXX 2.0
+.crypt,CryptXXX 3.0
+.cryp1,CryptXXX 3.0
+.crypz,CryptXXX 3.0
+.cryptz,CryptXXX 3.0
+.cryp1,CryptXXX 3.1
+.ctbl,CTB-Locker
+.encrypted,CuteRansomware
+.ded,DEDCryptor
+.domino,Domino
+.locked,EDA2 / HiddenTear
+.isis,EduCrypt
+.locked,EduCrypt
+.ha3,El-Polocker
+.enigma,Enigma
+.1txt,Enigma
+.exotic,Exotic
+.locked,Fakben
+.fantom,Fantom
+.Z81928819,GhostCrypt
+.purge,Globe v1
+.globe,Globe v3
+.locked,GNL Locker
+.crypt,Gomasom
+.herbst,Herbst
+.cry,Hi Buddy!
+.locky,Hucky
+.crime,iLock
+.crime,iLockLight
+.btc,Jigsaw
+.kkk,Jigsaw
+.fun,Jigsaw
+.gws,Jigsaw
+.porno,Jigsaw
+.payransom,Jigsaw
+.payms,Jigsaw
+.paymst,Jigsaw
+.AFD,Jigsaw
+.paybtcs,Jigsaw
+.epic,Jigsaw
+.xyz,Jigsaw
+.locked,Job Crypter
+.encrypted,KeRanger
+.keybtc@inbox_com,KeyBTC
+.rip,Killer Locker
+.kimcilware,KimcilWare
+.locked,KimcilWare
+.kostya,Kostya
+.kratos,KratosCrypt
+.LeChiffre,LeChiffre
+.locky,Locky
+.zepto,Locky
+.odin,Locky
+.shit,Locky
+.thor,Locky
+.asier,Locky
+.zzzzz,Locky
+.osiris,Locky
+.lock93,Lock93
+.crime,Lortok
+.oor,LowLevel04
+.magic,Magic
+.Lock,MIRCOP
+.fucked,MireWare
+.fuck,MireWare
+.locked,MM Locker
+.KEYZ,Mobef
+.KEYH0LES,Mobef
+.crypted,Nemucod
+.odcodc,ODCODC
+.cbf,Offline ransomware
+.LOL!,OMG! Ransomware
+.OMG!,OMG! Ransomware
+.padcrypt,PadCrypt
+.locked,Philadelphia
+.locked,PokemonGO
+.filock,Popcorn Time
+.locky,PowerWare
+.crypt,R980
+.locked,RAA encryptor
+.RDM,Radamant
+.RRK,Radamant
+.RAD,Radamant
+.RADAMANT,Radamant
+.locked,Rakhni
+.kraken,Rakhni
+.darkness,Rakhni
+.nochance,Rakhni
+.oshit,Rakhni
+.oplata@qq_com,Rakhni
+.relock@qq_com,Rakhni
+.crypto,Rakhni
+.helpdecrypt@ukr.net,Rakhni
+.pizda@qq_com,Rakhni
+.dyatel@qq_com,Rakhni
+._ryp,Rakhni
+.nalog@qq_com,Rakhni
+.chifrator@qq_com,Rakhni
+.gruzin@qq_com,Rakhni
+.troyancoder@qq_com,Rakhni
+.encrypted,Rakhni
+.cry,Rakhni
+.AES256,Rakhni
+.enc,Rakhni
+.hb15,Rakhni
+.vscrypt,Rector
+.infected,Rector
+.bloc,Rector
+.korrektor,Rector
+.rekt,RektLocker
+.remind,RemindMe
+.crashed,RemindMe
+.rokku,Rokku
+.encryptedAES,Samas-Samsam
+.encryptedRSA,Samas-Samsam
+.encedRSA,Samas-Samsam
+.justbtcwillhelpyou,Samas-Samsam
+.btcbtcbtc,Samas-Samsam
+.btc-help-you,Samas-Samsam
+.only-we_can-help_you,Samas-Samsam
+.iwanthelpuuu,Samas-Samsam
+.notfoundrans,Samas-Samsam
+.encmywork,Samas-Samsam
+.weapologize,Samas-Samsam
+.stubbin,Samas-Samsam
+.areyoulovemyrans,Samas-Samsam
+.loveransisgood,Samas-Samsam
+.myransext2017,Samas-Samsam
+.disposed2017,Samas-Samsam
+.prosperous666,Samas-Samsam
+.supported2017,Samas-Samsam
+.country82000,Samas-Samsam
+.moments2900,Samas-Samsam
+.breeding123,Samas-Samsam
+.mention9823,Samas-Samsam
+.suppose666,Samas-Samsam
+.skjdthghh,Samas-Samsam
+.cifgksaffsfyghd,Samas-Samsam
+.iaufkakfhsaraf,Samas-Samsam
+.filegofprencrp,Samas-Samsam
+.weencedufiles,Samas-Samsam
+.encryptedyourfiles,Samas-Samsam
+.letmetrydecfiles,Samas-Samsam
+.otherinformation,Samas-Samsam
+.weareyourfriends,Samas-Samsam
+.noproblemwedecfiles,Samas-Samsam
+.powerfulldecrypt,Samas-Samsam
+.wowreadfordecryp,Samas-Samsam
+.wowwhereismyfiles,Samas-Samsam
+.helpmeencedfiles,Samas-Samsam
+.theworldisyours,Samas-Samsam
+.vekanhelpu,Samas-Samsam
+.howcanihelpusir,Samas-Samsam
+.VforVendetta,Samas-Samsam
+.checkdiskenced,Samas-Samsam
+.goforhelp,Samas-Samsam
+.iloveworld,Samas-Samsam
+.canihelpyou,Samas-Samsam
+.AreYouLoveMyRansFile,Samas-Samsam
+.fucku,Samas-Samsam
+.happenencedfiles,Samas-Samsam
+.iwishiyou,Samas-Samsam
+.powerfulldecryp,Samas-Samsam
+.suppose665,Samas-Samsam
+.Whereisyourfiles,Samas-Samsam
+.sanction,Sanction
+.locked,Shark
+.shino,ShinoLocker
+.locked,SkidLocker / Pompous
+.encrypted,Smrss32
+.RSNSlocked,SNSLocker
+.RSplited,SNSLocker
+.sport,Sport
+.locked,Stampado
+.locked,Strictor
+.surprise,Surprise
+.tzu,Surprise
+.szf,SZFLocker
+.xcri,TeleCrypt
+.vvv,TeslaCrypt 0.x - 2.2.0
+.ecc,TeslaCrypt 0.x - 2.2.0
+.exx,TeslaCrypt 0.x - 2.2.0
+.ezz,TeslaCrypt 0.x - 2.2.0
+.abc,TeslaCrypt 0.x - 2.2.0
+.aaa,TeslaCrypt 0.x - 2.2.0
+.zzz,TeslaCrypt 0.x - 2.2.0
+.xyz,TeslaCrypt 0.x - 2.2.0
+.micro,TeslaCrypt 3.0+
+.xxx,TeslaCrypt 3.0+
+.ttt,TeslaCrypt 3.0+
+.mp3,TeslaCrypt 3.0+
+.Encrypted,TorrentLocker
+.enc,TorrentLocker
+.toxcrypt,Toxcrypt
+.better_call_saul,Troldesh
+.xtbl,Troldesh
+.da_vinci_code,Troldesh
+.windows10,Troldesh
+.enc,TrueCrypter
+.locked,Turkish Ransom
+.H3LL,Ungluk
+.0x0,Ungluk
+.1999,Ungluk
+.CRRRT,Unlock92
+.CCCRRRPPP,Unlock92
+.vault,VaultCrypt
+.xort,VaultCrypt
+.trun,VaultCrypt
+.Venusf,VenusLocker
+.Venusp,VenusLocker
+.CrySiS,Virus-Encoder
+.xtbl,Virus-Encoder
+.wflx,WildFire Locker
+.EnCiPhErEd,Xorist
+.73i87A,Xorist
+.p5tkjw,Xorist
+.PoAr2w,Xorist
+.fileiscryptedhard,Xorist
+.encoderpass,Xorist
+.zc3791,Xorist
+.xrtn,XRTN
+.zcrypt,Zcrypt
+.crypto,Zimbra
+.vault,Zlader / Russian
+.zyklon,Zyklon
+.wncry,WannaCry
+.wcry,WannaCry
+.wnry,WannaCry
+.wncryt,WannaCry
+.WNCRYT,WannaCry
+.RYK,Ryuk
+.Clop,Clop
+.Cllp,Clop
+.JSWORM,JSWorm
+.NEMTY_*,Nemty
+.NEFILIM,Nefilim
+.OFFWHITE,Offwhite
+.TELEGRAM,Telegram
+.FUSION,Fusion
+.MILIHPEN,Milihpen
+.GANGBANG,Gangbang
+.reddot,RedDot

dist/devsecops/lookups/ransomware_notes.csv

@@ -0,0 +1,69 @@
+ransomware_notes, status
+HELP_TO_SAVE_FILES.txt,True
+BitCryptorFileList.txt,True
+BUYUNLOCKCODE,True
+YOUR_FILES_ARE_ENCRYPTED.HTML,True
+Coin.Locker.txt,True
+DECRYPT_INSTRUCTIONS.HTML,True
+ReadDecryptFilesHere.txt,True
+HOW_DECRYPT.TXT,True
+READ IF YOU WANT YOUR FILES BACK.HTML,True
+GetYouFiles.txt,True
+HOW TO DECRYPT FILES.HTML,True
+DECRYPT_INSTRUCTION.TXT,True
+HELP_DECRYPT.TXT,True
+HELP_YOURFILES.HTML,True
+HowDecrypt.gif,True
+Decrypt All Files *.bmp,True
+cryptinfo.txt,True
+DECRYPT_Readme.TXT.ReadMe,True
+qwer.html,True
+qwer2.html,True
+Hellothere.txt,True
+FILESAREGONE.TXT,True
+HOW TO DECRYPT FILES.TXT,True
+DECRYPT_Readme.TXT.ReadMe,True
+README_DECRYPT_HYDRA_ID_*.txt,True
+DECRYPT_YOUR_FILES.HTML,True
+KryptoLocker_README.txt,True
+_Locky_recover_instructions.txt,True
+DECRYPT_Readme.TXT.ReadMe,True
+ATTENTION.RTF,True
+how to get data.txt,True
+IMPORTANT READ ME.txt,True
+UnblockFiles.vbs,True
+YOUR_FILES.url,True
+exit.hhr.obleep,True
+HOW_TO_DECRYPT.HTML,True
+HOW-TO-DECRYPT-FILES.HTML,True
+HELP_TO_SAVE_FILES.txt,True
+HELP_TO_SAVE_FILES.txt,True
+HELP_TO_SAVE_FILES.txt,True
+_H_e_l_p_RECOVER_INSTRUCTIONS+*.txt,True
+DECRYPT_INSTRUCTIONS.HTML,True
+README_DECRYPT_UMBRE_ID_*.txt,True
+Help_Decrypt.txt,True
+CryptLogFile.txt,True
+*@Please_Read_Me@.txt*,True
+*@WanaDecryptor@.exe*,True
+# DECRYPT MY FILES #.vbs,True
+# DECRYPT MY FILES #.html,True
+# DECRYPT MY FILES #.txt,True
+# DECRYPT MY FILES #.vbs,True
+# DECRYPT MY FILES #.html,True
+# DECRYPT MY FILES #.txt,True
+HELP_DECRYPT_YOUR_FILES.HTML,True
+*-HELP_FOR_DECRYPT_FILE.html,True
+*-SORRY-FOR-FILES.html,True
+*-READ-FOR-HELLPP.html,True
+RyukReadMe.html,True
+ClopReadMe.txt,True
+README_README.txt,True
+JSWORM-DECRYPT.html,True
+NEMTY_*-DECRYPT.txt,True
+NEFILIM-DECRYPT.txt,True
+OFFWHITE-MANUAL.txt,True
+TELEGRAM-RECOVER.txt,True
+FUSION-README.txt,True
+MILIHPEN-INSTRUCT.txt,True
+GANGBANG-NOTE.txt,True

dist/devsecops/lookups/rare_process_allow_list_default.csv

@@ -0,0 +1,7 @@
+process,allow_list
+splunk-regmon.exe,true
+winword.exe,true
+excel.exe,true
+outlook.exe,true
+powerpnt.exe,true
+visio.exe,true

dist/devsecops/lookups/rare_process_allow_list_local.csv

@@ -0,0 +1 @@
+process,allow_list

dist/devsecops/lookups/s3_deletion_baseline.csv

@@ -0,0 +1 @@
+arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls

dist/devsecops/lookups/security_group_activity_baseline.csv

@@ -0,0 +1 @@
+arn,latestCount,numDataPoints,avgApiCalls,stdevApiCalls

dist/devsecops/lookups/security_services.csv

@@ -0,0 +1,5 @@
+service,description,category
+*mpssvc*,Windows Firewall Service,security
+*wscsvc*,Windows Security Center Service,securty
+*windefend*,Windows Defender Service,security
+*sysmon*,Sysmon Driver,security

dist/devsecops/lookups/suspicious_files.csv

@@ -0,0 +1,4 @@
+file, note
+mssscardprv.ax,ESCU - File associated with Hidden Cobra malware https://www.us-cert.gov/ncas/analysis-reports/AR18-149A
+scardprv.dll,ESCU - File associated with Hidden Cobra malware https://www.us-cert.gov/ncas/analysis-reports/AR18-149A
+wmmvsvc.dll,ESCU - File associated with Hidden Cobra malware https://www.us-cert.gov/ncas/analysis-reports/AR18-149A

dist/devsecops/lookups/uncommon_processes_default.csv

@@ -0,0 +1,9 @@
+process_name,uncommon_default,category_default,analytic_story_default,kill_chain_phase_default,mitre_attack_default
+sethc.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
+utilman.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
+osk.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
+magnify.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
+narrator.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
+displayswitch.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
+atbroker.exe,true,needs_accessibility,Windows Privilege Escalation,Actions on Objectives,Execution|Accessibility Features
+quser.exe,true,,DHS Report TA18-074A|Unusual Processes,Actions on Objectives,Execution

dist/devsecops/lookups/uncommon_processes_local.csv

@@ -0,0 +1 @@
+process_name,uncommon_local,category_local,analytic_story_local,kill_chain_phase_local,mitre_attack_local

dist/devsecops/metadata/default.meta

@@ -0,0 +1,35 @@
+
+# Application-level permissions
+
+[]
+access = read : [ * ], write : [ admin, power ]
+
+### EVENT TYPES
+
+[eventtypes]
+export = system
+
+
+### PROPS
+
+[props]
+export = system
+
+
+### TRANSFORMS
+
+[transforms]
+export = system
+
+
+### LOOKUPS
+
+[lookups]
+export = system
+
+
+### VIEWSTATES: even normal users should be able to create shared viewstates
+
+[viewstates]
+access = read : [ * ], write : [ * ]
+export = system

lookups/images_to_repository.csv

@@ -0,0 +1,3 @@
+image, repository
+devsecops/cat_dog_client, splunk/devsecops_poc
+devsecops/cat_dog_server, splunk/devsecops_poc

lookups/images_to_repository.yml

@@ -0,0 +1,3 @@
+description: Mapping images to repositories
+filename: images_to_repository.csv
+name: images_to_repository

macros/signals.yml

@@ -0,0 +1,4 @@
+definition: index=signals
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: signals

stories/dev_sec_ops.yml

@@ -21,4 +21,5 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
+  - Dev Sec Ops Analytics
   usecase: Security Monitoring